first commit

admin/tool/dataprivacy/classes/external/category_exporter.php

@@ -0,0 +1,79 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Class for exporting data category.
+ *
+ * @package    tool_dataprivacy
+ * @copyright  2018 David Monllao
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+namespace tool_dataprivacy\external;
+defined('MOODLE_INTERNAL') || die();
+
+use core\external\persistent_exporter;
+use tool_dataprivacy\category;
+use tool_dataprivacy\context_instance;
+
+/**
+ * Class for exporting field data.
+ *
+ * @copyright  2018 David Monllao
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class category_exporter extends persistent_exporter {
+
+    /**
+     * Defines the persistent class.
+     *
+     * @return string
+     */
+    protected static function define_class() {
+        return \tool_dataprivacy\category::class;
+    }
+
+    /**
+     * Returns a list of objects that are related.
+     *
+     * @return array
+     */
+    protected static function define_related() {
+        return array(
+            'context' => 'context',
+        );
+    }
+
+    /**
+     * Utility function that fetches a category name from the given ID.
+     *
+     * @param int $categoryid The category ID. Could be INHERIT (false, -1), NOT_SET (0), or the actual ID.
+     * @return string The purpose name.
+     */
+    public static function get_name($categoryid) {
+        global $PAGE;
+        if ($categoryid === false || $categoryid == context_instance::INHERIT) {
+            return get_string('inherit', 'tool_dataprivacy');
+        } else if ($categoryid == context_instance::NOTSET) {
+            return get_string('notset', 'tool_dataprivacy');
+        } else {
+            $purpose = new category($categoryid);
+            $output = $PAGE->get_renderer('tool_dataprivacy');
+            $exporter = new self($purpose, ['context' => \context_system::instance()]);
+            $data = $exporter->export($output);
+            return $data->name;
+        }
+    }
+}

admin/tool/dataprivacy/classes/external/context_instance_exporter.php

@@ -0,0 +1,45 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Class for exporting context instance.
+ *
+ * @package    tool_dataprivacy
+ * @copyright  2018 David Monllao
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+namespace tool_dataprivacy\external;
+defined('MOODLE_INTERNAL') || die();
+
+use core\external\persistent_exporter;
+
+/**
+ * Class for exporting context instance.
+ *
+ * @copyright  2018 David Monllao
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class context_instance_exporter extends persistent_exporter {
+
+    /**
+     * Defines the persistent class.
+     *
+     * @return string
+     */
+    protected static function define_class() {
+        return \tool_dataprivacy\context_instance::class;
+    }
+}

admin/tool/dataprivacy/classes/external/create_data_request.php

@@ -0,0 +1,121 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_dataprivacy\external;
+
+use core_external\external_api;
+use core_external\external_function_parameters;
+use core_external\external_single_structure;
+use core_external\external_value;
+use core_external\external_warnings;
+use tool_dataprivacy\api;
+use core_user;
+use moodle_exception;
+
+/**
+ * External function for creating a data request.
+ *
+ * @package    tool_dataprivacy
+ * @copyright  2023 Juan Leyva <juan@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @since      Moodle 4.4
+ */
+class create_data_request extends external_api {
+
+    /**
+     * Webservice parameters.
+     *
+     * @return external_function_parameters
+     */
+    public static function execute_parameters(): external_function_parameters {
+        return new external_function_parameters(
+            [
+                'type' => new external_value(PARAM_INT, 'The type of data request to create. 1 for export, 2 for data deletion.'),
+                'comments' => new external_value(PARAM_RAW, 'Comments for the data request.', VALUE_DEFAULT, ''),
+                'foruserid' => new external_value(PARAM_INT, 'The id of the user to create the data request for. Empty for current user.',
+                    VALUE_DEFAULT, 0),
+            ]
+        );
+    }
+
+    /**
+     * Create a data request.
+     *
+     * @param int $type The type of data request to create.
+     * @param string $comments Comments for the data request.
+     * @param int $foruserid The id of the user to create the data request for.
+     * @return array containing the id of the request created and warnings.
+     * @throws moodle_exception
+     */
+    public static function execute(int $type, string $comments = '', int $foruserid = 0): array {
+        global $USER;
+
+        $params = self::validate_parameters(self::execute_parameters(), [
+            'type' => $type,
+            'comments' => $comments,
+            'foruserid' => $foruserid,
+        ]);
+
+        $system = \context_system::instance();
+        external_api::validate_context($system);
+
+        $cancontactdpo = api::can_contact_dpo();
+        $canmanage = false;
+
+        if (empty($params['foruserid']) || $params['foruserid'] == $USER->id) {
+            $user = $USER;
+        } else {
+            $user = core_user::get_user($params['foruserid'], '*', MUST_EXIST);
+            core_user::require_active_user($user);
+
+            if (!$canmanage = api::can_manage_data_requests($user->id)) {
+                api::require_can_create_data_request_for_user($user->id);
+            }
+        }
+
+        if (!$canmanage && !$cancontactdpo) {
+            throw new moodle_exception('contactdpoviaprivacypolicy', 'tool_dataprivacy');
+        }
+
+        // Validate the data.
+        $validationerrors = api::validate_create_data_request((object) ['userid' => $user->id, 'type' => $params['type']]);
+        if (!empty($validationerrors)) {
+            $error = array_key_first($validationerrors);
+            throw new moodle_exception($error, 'tool_dataprivacy');
+        }
+        // All clear now, create the request.
+        $datarequest = api::create_data_request($user->id, $params['type'], $params['comments']);
+
+        return [
+            'datarequestid' => $datarequest->get('id'),
+            'warnings' => [],
+        ];
+    }
+
+    /**
+     * Webservice returns.
+     *
+     * @return external_single_structure
+     */
+    public static function execute_returns(): external_single_structure {
+        return new external_single_structure(
+            [
+                'datarequestid' => new external_value(PARAM_INT, 'The id of the created data request.'),
+                'warnings' => new external_warnings(),
+            ]
+        );
+    }
+}

admin/tool/dataprivacy/classes/external/data_request_exporter.php

@@ -0,0 +1,219 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Class for exporting user evidence with all competencies.
+ *
+ * @package    tool_dataprivacy
+ * @copyright  2018 Jun Pataleta
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+namespace tool_dataprivacy\external;
+defined('MOODLE_INTERNAL') || die();
+
+use core\external\persistent_exporter;
+use core_user;
+use core_user\external\user_summary_exporter;
+use renderer_base;
+use tool_dataprivacy\api;
+use tool_dataprivacy\data_request;
+use tool_dataprivacy\local\helper;
+
+/**
+ * Class for exporting user evidence with all competencies.
+ *
+ * @copyright  2018 Jun Pataleta
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class data_request_exporter extends persistent_exporter {
+
+    /**
+     * Class definition.
+     *
+     * @return string
+     */
+    protected static function define_class() {
+        return data_request::class;
+    }
+
+    /**
+     * Related objects definition.
+     *
+     * @return array
+     */
+    protected static function define_related() {
+        return [
+            'context' => 'context',
+        ];
+    }
+
+    /**
+     * Other properties definition.
+     *
+     * @return array
+     */
+    protected static function define_other_properties() {
+        return [
+            'foruser' => [
+                'type' => user_summary_exporter::read_properties_definition(),
+            ],
+            'requestedbyuser' => [
+                'type' => user_summary_exporter::read_properties_definition(),
+                'optional' => true
+            ],
+            'dpouser' => [
+                'type' => user_summary_exporter::read_properties_definition(),
+                'optional' => true
+            ],
+            'messagehtml' => [
+                'type' => PARAM_RAW,
+                'optional' => true
+            ],
+            'typename' => [
+                'type' => PARAM_TEXT,
+            ],
+            'typenameshort' => [
+                'type' => PARAM_TEXT,
+            ],
+            'statuslabel' => [
+                'type' => PARAM_TEXT,
+            ],
+            'statuslabelclass' => [
+                'type' => PARAM_TEXT,
+            ],
+            'canreview' => [
+                'type' => PARAM_BOOL,
+                'optional' => true,
+                'default' => false
+            ],
+            'approvedeny' => [
+                'type' => PARAM_BOOL,
+                'optional' => true,
+                'default' => false
+            ],
+            'allowfiltering' => [
+                'type' => PARAM_BOOL,
+                'optional' => true,
+                'default' => false,
+            ],
+            'canmarkcomplete' => [
+                'type' => PARAM_BOOL,
+                'optional' => true,
+                'default' => false
+            ],
+            'downloadlink' => [
+                'type' => PARAM_URL,
+                'optional' => true,
+            ],
+        ];
+    }
+
+    /**
+     * Assign values to the defined other properties.
+     *
+     * @param renderer_base $output The output renderer object.
+     * @return array
+     * @throws coding_exception
+     * @throws dml_exception
+     * @throws moodle_exception
+     */
+    protected function get_other_values(renderer_base $output) {
+        $values = [];
+
+        $foruserid = $this->persistent->get('userid');
+        $user = core_user::get_user($foruserid, '*', MUST_EXIST);
+        $userexporter = new user_summary_exporter($user);
+        $values['foruser'] = $userexporter->export($output);
+
+        $requestedbyid = $this->persistent->get('requestedby');
+        if ($requestedbyid != $foruserid) {
+            $user = core_user::get_user($requestedbyid, '*', MUST_EXIST);
+            $userexporter = new user_summary_exporter($user);
+            $values['requestedbyuser'] = $userexporter->export($output);
+        } else {
+            $values['requestedbyuser'] = $values['foruser'];
+        }
+
+        if (!empty($this->persistent->get('dpo'))) {
+            $dpoid = $this->persistent->get('dpo');
+            $user = core_user::get_user($dpoid, '*', MUST_EXIST);
+            $userexporter = new user_summary_exporter($user);
+            $values['dpouser'] = $userexporter->export($output);
+        }
+
+        $values['messagehtml'] = text_to_html($this->persistent->get('comments'));
+
+        $requesttype = $this->persistent->get('type');
+        $values['typename'] = helper::get_request_type_string($requesttype);
+        $values['typenameshort'] = helper::get_shortened_request_type_string($requesttype);
+
+        $values['canreview'] = false;
+        $values['approvedeny'] = false;
+        $values['allowfiltering'] = get_config('tool_dataprivacy', 'allowfiltering');
+        $values['statuslabel'] = helper::get_request_status_string($this->persistent->get('status'));
+
+        switch ($this->persistent->get('status')) {
+            case api::DATAREQUEST_STATUS_PENDING:
+            case api::DATAREQUEST_STATUS_PREPROCESSING:
+                $values['statuslabelclass'] = 'bg-info text-white';
+                // Request can be manually completed for general enquiry requests.
+                $values['canmarkcomplete'] = $requesttype == api::DATAREQUEST_TYPE_OTHERS;
+                break;
+            case api::DATAREQUEST_STATUS_AWAITING_APPROVAL:
+                $values['statuslabelclass'] = 'bg-info text-white';
+                // DPO can review the request once it's ready.
+                $values['canreview'] = true;
+                // Whether the DPO can approve or deny the request.
+                $values['approvedeny'] = in_array($requesttype, [api::DATAREQUEST_TYPE_EXPORT, api::DATAREQUEST_TYPE_DELETE]);
+                // If the request's type is delete, check if user have permission to approve/deny it.
+                if ($requesttype == api::DATAREQUEST_TYPE_DELETE) {
+                    $values['approvedeny'] = api::can_create_data_deletion_request_for_other();
+                }
+                break;
+            case api::DATAREQUEST_STATUS_APPROVED:
+                $values['statuslabelclass'] = 'bg-info text-white';
+                break;
+            case api::DATAREQUEST_STATUS_PROCESSING:
+                $values['statuslabelclass'] = 'bg-info text-white';
+                break;
+            case api::DATAREQUEST_STATUS_COMPLETE:
+            case api::DATAREQUEST_STATUS_DOWNLOAD_READY:
+            case api::DATAREQUEST_STATUS_DELETED:
+                $values['statuslabelclass'] = 'bg-success text-white';
+                break;
+            case api::DATAREQUEST_STATUS_CANCELLED:
+                $values['statuslabelclass'] = 'bg-warning text-dark';
+                break;
+            case api::DATAREQUEST_STATUS_REJECTED:
+                $values['statuslabelclass'] = 'bg-danger text-white';
+                break;
+            case api::DATAREQUEST_STATUS_EXPIRED:
+                $values['statuslabelclass'] = 'bg-secondary text-dark';
+                break;
+        }
+
+        if ($this->persistent->get('status') == api::DATAREQUEST_STATUS_DOWNLOAD_READY) {
+            $usercontext = \context_user::instance($foruserid, IGNORE_MISSING);
+            // If user has permission to view download link, show relevant action item.
+            if ($usercontext && api::can_download_data_request_for_user($foruserid, $requestedbyid)) {
+                $downloadlink = api::get_download_link($usercontext, $this->persistent->get('id'))->url;
+                $values['downloadlink'] = $downloadlink->out(false);
+            }
+        }
+
+        return $values;
+    }
+}

admin/tool/dataprivacy/classes/external/get_access_information.php

@@ -0,0 +1,85 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_dataprivacy\external;
+
+use core_external\external_api;
+use core_external\external_function_parameters;
+use core_external\external_single_structure;
+use core_external\external_value;
+use core_external\external_warnings;
+use tool_dataprivacy\api;
+
+/**
+ * External function for retrieving access (permissions) information for the privacy API.
+ *
+ * @package    tool_dataprivacy
+ * @copyright  2023 Juan Leyva <juan@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @since      Moodle 4.4
+ */
+class get_access_information extends external_api {
+
+    /**
+     * Webservice parameters.
+     *
+     * @return external_function_parameters
+     */
+    public static function execute_parameters(): external_function_parameters {
+        return new external_function_parameters([]);
+    }
+
+    /**
+     * Main method of the external function.
+     *
+     * @return array current user permissions
+     */
+    public static function execute(): array {
+        global $USER;
+
+        $system = \context_system::instance();
+        external_api::validate_context($system);
+
+        return [
+            'cancontactdpo' => api::can_contact_dpo(),
+            'canmanagedatarequests' => api::can_manage_data_requests($USER->id),
+            'cancreatedatadownloadrequest' => api::can_create_data_download_request_for_self($USER->id),
+            'cancreatedatadeletionrequest' => api::can_create_data_deletion_request_for_self($USER->id),
+            'hasongoingdatadownloadrequest' => api::has_ongoing_request($USER->id, api::DATAREQUEST_TYPE_EXPORT),
+            'hasongoingdatadeletionrequest' => api::has_ongoing_request($USER->id, api::DATAREQUEST_TYPE_DELETE),
+            'warnings' => [],
+        ];
+    }
+
+    /**
+     * Webservice returns.
+     *
+     * @return external_single_structure
+     */
+    public static function execute_returns(): external_single_structure {
+        return new external_single_structure(
+            [
+                'cancontactdpo' => new external_value(PARAM_BOOL, 'Can contact dpo.'),
+                'canmanagedatarequests' => new external_value(PARAM_BOOL, 'Can manage data requests.'),
+                'cancreatedatadownloadrequest' => new external_value(PARAM_BOOL, 'Can create data download request for self.'),
+                'cancreatedatadeletionrequest' => new external_value(PARAM_BOOL, 'Can create data deletion request for self.'),
+                'hasongoingdatadownloadrequest' => new external_value(PARAM_BOOL, 'Has ongoing data download request.'),
+                'hasongoingdatadeletionrequest' => new external_value(PARAM_BOOL, 'Has ongoing data deletion request.'),
+                'warnings' => new external_warnings(),
+            ]
+        );
+    }
+}

admin/tool/dataprivacy/classes/external/get_data_requests.php

@@ -0,0 +1,165 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+namespace tool_dataprivacy\external;
+
+use core_external\external_api;
+use core_external\external_function_parameters;
+use core_external\external_single_structure;
+use core_external\external_multiple_structure;
+use core_external\external_value;
+use core_external\external_warnings;
+use tool_dataprivacy\api;
+use core_user;
+use context_system;
+use moodle_exception;
+
+/**
+ * External function for getting data requests.
+ *
+ * @package    tool_dataprivacy
+ * @copyright  2023 Juan Leyva <juan@moodle.com>
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @since      Moodle 4.4
+ */
+class get_data_requests extends external_api {
+
+    /**
+     * Webservice parameters.
+     *
+     * @return external_function_parameters
+     */
+    public static function execute_parameters(): external_function_parameters {
+        return new external_function_parameters(
+            [
+                'userid' => new external_value(PARAM_INT, 'The id of the user to get the data requests for. Empty for all users.',
+                    VALUE_DEFAULT, 0),
+                'statuses' => new external_multiple_structure(
+                    new external_value(PARAM_INT, 'The status of the data requests to get.'),
+                    'The statuses of the data requests to get.
+                    0 for pending 1 preprocessing, 2 awaiting approval, 3 approved,
+                    4 processed, 5 completed, 6 cancelled, 7 rejected.',
+                    VALUE_DEFAULT,
+                    []
+                ),
+                'types' => new external_multiple_structure(
+                    new external_value(PARAM_INT, 'The type of the data requests to get.'),
+                    'The types of the data requests to get. 1 for export, 2 for data deletion.',
+                    VALUE_DEFAULT,
+                    []
+                ),
+                'creationmethods' => new external_multiple_structure(
+                    new external_value(PARAM_INT, 'The creation method of the data requests to get.'),
+                    'The creation methods of the data requests to get. 0 for manual, 1 for automatic.',
+                    VALUE_DEFAULT,
+                    []
+                ),
+                'sort' => new external_value(PARAM_NOTAGS, 'The field to sort the data requests by.',
+                    VALUE_DEFAULT, ''),
+                'limitfrom' => new external_value(PARAM_INT, 'The number to start getting the data requests from.',
+                    VALUE_DEFAULT, 0),
+                'limitnum' => new external_value(PARAM_INT, 'The number of data requests to get.',
+                    VALUE_DEFAULT, 0),
+            ]
+        );
+    }
+
+
+    /**
+     * Get data requests.
+     *
+     * @param int $userid The user id.
+     * @param array $statuses The status filters.
+     * @param array $types The request type filters.
+     * @param array $creationmethods The request creation method filters.
+     * @param string $sort The order by clause.
+     * @param int $limitfrom Amount of records to skip.
+     * @param int $limitnum Amount of records to fetch.
+     * @throws moodle_exception
+     * @return array containing the data requests and warnings.
+     */
+    public static function execute($userid = 0, $statuses = [], $types = [], $creationmethods = [],
+            $sort = '', $limitfrom = 0, $limitnum = 0): array {
+
+        global $USER, $PAGE;
+
+        $params = self::validate_parameters(self::execute_parameters(), [
+            'userid' => $userid,
+            'statuses' => $statuses,
+            'types' => $types,
+            'creationmethods' => $creationmethods,
+            'sort' => $sort,
+            'limitfrom' => $limitfrom,
+            'limitnum' => $limitnum,
+        ]);
+        $systemcontext = context_system::instance();
+
+        if ($params['userid'] == $USER->id) {
+            $userid = $USER->id;
+        } else {
+            // Additional security checks when obtaining data requests for other users.
+            if (!has_capability('tool/dataprivacy:managedatarequests', $systemcontext) || !api::is_site_dpo($USER->id)) {
+                $dponamestring = implode (', ', api::get_dpo_role_names());
+                throw new moodle_exception('privacyofficeronly', 'tool_dataprivacy', '', $dponamestring);
+            }
+
+            $userid = 0;
+            if (!empty($params['userid'])) {
+                $user = core_user::get_user($params['userid'], '*', MUST_EXIST);
+                core_user::require_active_user($user);
+                $userid = $user->id;
+            }
+        }
+
+        // Ensure sort parameter is safe to use. Fallback to default value of the parameter itself.
+        $sortorderparts = explode(' ', $params['sort'], 2);
+        $sortorder = get_safe_orderby([
+            'id' => 'id',
+            'status' => 'status',
+            'timemodified' => 'timemodified',
+            'default' => '',
+        ], $sortorderparts[0], $sortorderparts[1] ?? '', false);
+
+        $userrequests = api::get_data_requests($userid, $params['statuses'], $params['types'], $params['creationmethods'],
+                $sortorder, $params['limitfrom'], $params['limitnum']);
+
+        $requests = [];
+        foreach ($userrequests as $requestpersistent) {
+            $exporter = new data_request_exporter($requestpersistent, ['context' => $systemcontext]);
+            $renderer = $PAGE->get_renderer('tool_dataprivacy');
+            $requests[] = $exporter->export($renderer);
+        }
+
+        return [
+            'requests' => $requests,
+            'warnings' => [],
+        ];
+    }
+
+    /**
+     * Webservice returns.
+     *
+     * @return external_single_structure
+     */
+    public static function execute_returns(): external_single_structure {
+        return new external_single_structure(
+            [
+                'requests' => new external_multiple_structure(data_request_exporter::get_read_structure(), 'The data requests.'),
+                'warnings' => new external_warnings(),
+            ]
+        );
+    }
+}

admin/tool/dataprivacy/classes/external/name_description_exporter.php

@@ -0,0 +1,63 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Class for exporting an object containing a name and a description.
+ *
+ * @package    tool_dataprivacy
+ * @copyright  2018 Jun Pataleta
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+namespace tool_dataprivacy\external;
+defined('MOODLE_INTERNAL') || die();
+
+use core\external\exporter;
+
+/**
+ * Class that exports an object containing a name and a description.
+ *
+ * @copyright  2018 Jun Pataleta
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class name_description_exporter extends exporter {
+
+    /**
+     * Returns a list of objects that are related.
+     *
+     * @return array
+     */
+    protected static function define_related() {
+        return array(
+            'context' => 'context',
+        );
+    }
+
+    /**
+     * Return the list of properties.
+     *
+     * @return array
+     */
+    protected static function define_properties() {
+        return [
+            'name' => [
+                'type' => PARAM_TEXT,
+            ],
+            'description' => [
+                'type' => PARAM_TEXT,
+            ],
+        ];
+    }
+}

admin/tool/dataprivacy/classes/external/purpose_exporter.php

@@ -0,0 +1,159 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Class for exporting data purpose.
+ *
+ * @package    tool_dataprivacy
+ * @copyright  2018 David Monllao
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+namespace tool_dataprivacy\external;
+defined('MOODLE_INTERNAL') || die();
+
+use core\external\persistent_exporter;
+use renderer_base;
+use tool_dataprivacy\context_instance;
+use tool_dataprivacy\purpose;
+
+/**
+ * Class for exporting field data.
+ *
+ * @copyright  2018 David Monllao
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+class purpose_exporter extends persistent_exporter {
+
+    /**
+     * Defines the persistent class.
+     *
+     * @return string
+     */
+    protected static function define_class() {
+        return purpose::class;
+    }
+
+    /**
+     * Returns a list of objects that are related.
+     *
+     * @return array
+     */
+    protected static function define_related() {
+        return array(
+            'context' => 'context',
+        );
+    }
+
+    /**
+     * Return the list of additional properties.
+     *
+     * @return array
+     */
+    protected static function define_other_properties() {
+        return [
+            'formattedretentionperiod' => [
+                'type' => PARAM_TEXT
+            ],
+            'formattedlawfulbases' => [
+                'type' => name_description_exporter::read_properties_definition(),
+                'multiple' => true
+            ],
+            'formattedsensitivedatareasons' => [
+                'type' => name_description_exporter::read_properties_definition(),
+                'multiple' => true,
+                'optional' => true
+            ],
+            'roleoverrides' => [
+                'type' => PARAM_TEXT
+            ],
+        ];
+    }
+
+    /**
+     * Return other properties.
+     *
+     * @param renderer_base $output
+     * @return array
+     * @throws coding_exception
+     * @throws Exception
+     */
+    protected function get_other_values(renderer_base $output) {
+        $values = [];
+
+        $formattedbases = [];
+        $lawfulbases = explode(',', $this->persistent->get('lawfulbases'));
+        if (!empty($lawfulbases)) {
+            foreach ($lawfulbases as $basis) {
+                if (empty(trim($basis))) {
+                    continue;
+                }
+                $formattedbases[] = (object)[
+                    'name' => get_string($basis . '_name', 'tool_dataprivacy'),
+                    'description' => get_string($basis . '_description', 'tool_dataprivacy')
+                ];
+            }
+        }
+        $values['formattedlawfulbases'] = $formattedbases;
+
+        $formattedsensitivereasons = [];
+        $sensitivereasons = explode(',', $this->persistent->get('sensitivedatareasons') ?? '');
+        if (!empty($sensitivereasons)) {
+            foreach ($sensitivereasons as $reason) {
+                if (empty(trim($reason))) {
+                    continue;
+                }
+                $formattedsensitivereasons[] = (object)[
+                    'name' => get_string($reason . '_name', 'tool_dataprivacy'),
+                    'description' => get_string($reason . '_description', 'tool_dataprivacy')
+                ];
+            }
+        }
+        $values['formattedsensitivedatareasons'] = $formattedsensitivereasons;
+
+        $retentionperiod = $this->persistent->get('retentionperiod');
+        if ($retentionperiod) {
+            $formattedtime = \tool_dataprivacy\api::format_retention_period(new \DateInterval($retentionperiod));
+        } else {
+            $formattedtime = get_string('retentionperiodnotdefined', 'tool_dataprivacy');
+        }
+        $values['formattedretentionperiod'] = $formattedtime;
+
+        $values['roleoverrides'] = !empty($this->persistent->get_purpose_overrides());
+
+        return $values;
+    }
+
+    /**
+     * Utility function that fetches a purpose name from the given ID.
+     *
+     * @param int $purposeid The purpose ID. Could be INHERIT (false, -1), NOT_SET (0), or the actual ID.
+     * @return string The purpose name.
+     */
+    public static function get_name($purposeid) {
+        global $PAGE;
+        if ($purposeid === false || $purposeid == context_instance::INHERIT) {
+            return get_string('inherit', 'tool_dataprivacy');
+        } else if ($purposeid == context_instance::NOTSET) {
+            return get_string('notset', 'tool_dataprivacy');
+        } else {
+            $purpose = new purpose($purposeid);
+            $output = $PAGE->get_renderer('tool_dataprivacy');
+            $exporter = new self($purpose, ['context' => \context_system::instance()]);
+            $data = $exporter->export($output);
+            return $data->name;
+        }
+    }
+}

admin/tool/dataprivacy/classes/external/submit_selected_courses_form.php

@@ -0,0 +1,131 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Class for submit selected courses from form.
+ *
+ * @package    tool_dataprivacy
+ * @copyright  2021 The Open University.
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+namespace tool_dataprivacy\external;
+
+use core_external\external_api;
+use core_external\external_function_parameters;
+use core_external\external_single_structure;
+use core_external\external_value;
+use core_external\external_warnings;
+use core\notification;
+use context_system;
+
+/**
+ * Class for submit selected courses from form.
+ *
+ * @copyright  2021 The Open University.
+ * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @since Moodle 4.3
+ */
+class submit_selected_courses_form extends external_api {
+    /**
+     * Parameter description for get_data_request().
+     *
+     * @return external_function_parameters
+     */
+    public static function execute_parameters(): external_function_parameters {
+        return new external_function_parameters([
+            'requestid' => new external_value(PARAM_INT, 'The id of data request'),
+            'jsonformdata' => new external_value(PARAM_RAW, 'The data of selected courses form, encoded as a json array'),
+        ]);
+    }
+
+    /**
+     * Fetch the list of course which user can select to export data.
+     *
+     * @param int $requestid The request ID.
+     * @param string $jsonformdata The data of selected courses form.
+     * @return array
+     */
+    public static function execute(int $requestid, string $jsonformdata): array {
+
+        $warnings = [];
+        $result = false;
+        $params = self::validate_parameters(self::execute_parameters(), [
+            'requestid' => $requestid,
+            'jsonformdata' => $jsonformdata,
+        ]);
+
+        $context = context_system::instance();
+        self::validate_context($context);
+
+        // Make sure the user has the proper capability.
+        require_capability('tool/dataprivacy:managedatarequests', $context);
+
+        $requestid = $params['requestid'];
+        $serialiseddata = json_decode($params['jsonformdata']);
+        $data = array();
+        parse_str($serialiseddata, $data);
+
+        $mform = new \tool_dataprivacy\form\exportfilter_form(null, ['requestid' => $requestid], 'post', '', null, true, $data);
+
+        if (PHPUNIT_TEST) {
+            $validateddata = $mform->mock_ajax_submit($data);
+        } else {
+            $validateddata = $mform->get_data();
+        }
+        if ($validateddata) {
+            // Ensure the request exists.
+            $requestexists = \tool_dataprivacy\data_request::record_exists($requestid);
+
+            if ($requestexists) {
+                $coursecontextids = [];
+                if (!empty($validateddata->coursecontextids)) {
+                    $coursecontextids = $validateddata->coursecontextids;
+                }
+                if (PHPUNIT_TEST) {
+                    if (!empty($validateddata['coursecontextids'])) {
+                        $coursecontextids = $validateddata['coursecontextids'];
+                    }
+                }
+                $result = \tool_dataprivacy\api::approve_data_request($requestid, $coursecontextids);
+
+                // Add notification in the session to be shown when the page is reloaded on the JS side.
+                notification::success(get_string('requestapproved', 'tool_dataprivacy'));
+            } else {
+                $warnings = [
+                    'item' => $requestid,
+                    'warningcode' => 'errorrequestnotfound',
+                    'message' => get_string('errorrequestnotfound', 'tool_dataprivacy'),
+                ];
+            }
+        }
+        return [
+            'result' => $result,
+            'warnings' => $warnings,
+        ];
+    }
+
+    /**
+     * Parameter description for submit_selected_courses_form().
+     *
+     * @return external_single_structure
+     */
+    public static function execute_returns(): external_single_structure {
+        return new external_single_structure([
+            'result' => new external_value(PARAM_BOOL, 'The processing result'),
+            'warnings' => new external_warnings(),
+        ]);
+    }
+}