Add processing activity exports

[SachaProbo]

processing-activities-2026-01-12-4.pdf
data-protection-impact-assessments-2026-01-12.pdf
transfer-impact-assessments-2026-01-12.pdf

---

Summary by cubic

Add PDF export for processing activities, DPIAs, and TIAs. Includes console UI, GraphQL mutations, server-side HTML-to-PDF generation, and permissions.

• New Features
  • Console: export actions on ProcessingActivitiesPage with spinner/toasts; downloads PDF via downloadFile; supports snapshot filtering.
  • API: new mutations exportProcessingActivitiesPDF, exportDataProtectionImpactAssessmentsPDF, exportTransferImpactAssessmentsPDF (return base64 PDF data).
  • Backend: services load org data, render HTML templates, convert via html2pdf; new authz actions added for each export.
  • Templates: A4 HTML templates for processing activities, DPIAs, and TIAs.
  • Tests: e2e coverage for processing activities, DPIA, and TIA PDF exports.

^{Written for commit c9f5ba3. Summary will update on new commits.}

[cubic-dev-ai]

6 issues found across 21 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="pkg/probo/data_protection_impact_assessment_service.go">

<violation number="1" location="pkg/probo/data_protection_impact_assessment_service.go:383">
P1: PDF generation should happen outside the database transaction to keep it short-lived. Fetch data within the transaction, then perform HTML rendering and PDF generation afterward.

(Based on your team&#39;s feedback about splitting data fetching and PDF generation.) [FEEDBACK_USED]</violation>
</file>

<file name="pkg/probo/processing_activity_service.go">

<violation number="1" location="pkg/probo/processing_activity_service.go:459">
P1: PDF generation is performed inside the database transaction, which can hold connections open for extended periods. Move `RenderProcessingActivitiesTableHTML`, `GeneratePDF`, and `io.ReadAll` outside the transaction - fetch data within the transaction, then generate the PDF afterward.

(Based on your team&#39;s feedback about splitting data fetching and PDF generation.) [FEEDBACK_USED]</violation>
</file>

<file name="pkg/probo/transfer_impact_assessment_service.go">

<violation number="1" location="pkg/probo/transfer_impact_assessment_service.go:383">
P1: PDF generation should happen outside the database transaction. Fetch all required data within the transaction, then perform HTML rendering and PDF generation afterward. This keeps the transaction short-lived and prevents holding database connections during potentially slow PDF operations.

(Based on your team&#39;s feedback about splitting data fetching and PDF generation.) [FEEDBACK_USED]</violation>
</file>

<file name="e2e/console/processing_activity_test.go">

<violation number="1" location="e2e/console/processing_activity_test.go:2710">
P2: Test uses wrong client: `owner.Do()` should be `newOwner.Do()`. The test creates `newOwner` to get a fresh organization with no TIAs, but executes the query using `owner` from the outer scope.</violation>

<violation number="2" location="e2e/console/processing_activity_test.go:2710">
P2: Test uses wrong client: `owner.Do()` should be `newOwner.Do()`. The test creates `newOwner` to get a fresh organization with no DPIAs, but executes the query using `owner` from the outer scope.</violation>

<violation number="3" location="e2e/console/processing_activity_test.go:2710">
P2: Test uses wrong client: `owner.Do()` should be `newOwner.Do()`. The test creates `newOwner` to get a fresh organization with no processing activities, but executes the query using `owner` from the outer scope. This could cause the test to pass for wrong reasons or fail with authorization errors instead of the expected &quot;no processing activities found&quot; error.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}