Release v0.1.7: Batch Re-Screening, Auth/RBAC, Audit Logging, GDPR & Credits Integration

12 February 2026

What changed

• Batch re-screening — Monitored people are now automatically re-screened whenever any sanctions list (OFSI, EU, UN, OFAC) updates. Reviewer decisions (confirmed, dismissed, investigating) are preserved; only pending matches are re-evaluated. New rescreen_runs table tracks each run. Manual triggers available via POST /api/screening/batch-rescreen.
• Authentication & RBAC — New role-based access control with admin/user roles and multi-tenant isolation via organisationId. Admin role required for manual batch re-screen triggers. Access violations are audit-logged.
• Audit logging (SOC 2) — Enhanced immutable audit log now captures IP address and user agent. New writeAuditLogWithRequest() helper extracts headers from Vercel/Cloudflare. Typed AuditActions constant for all action strings.
• Privacy & cookie consent (GDPR) — New /privacy and /terms pages. Cookie consent banner with Accept All, Necessary Only, and granular analytics/marketing preferences. Consent persisted to database via /api/cookie-consent with IP/UA for GDPR record-keeping.
• Credits integration — Batch re-screening and nightly sync are now fully wired into the PAYG credit system with audit logging.

Why it matters

This is the release that turns Calmony Sanction Monitor from a one-time screening tool into a continuous monitoring platform. People are now re-screened automatically — not just at import — closing the biggest feature gap. SOC 2 and GDPR foundations are in place for compliance-conscious customers.

Technical notes

• New DB tables: rescreen_runs, cookie_consent
• Schema changes: role and organisationId added to users; ip_address, user_agent, and new indexes added to audit_log
• New libraries: src/lib/batch-rescreen.ts, src/lib/rbac.ts, src/lib/audit.ts
• Nightly sync workflow gains rescreen_only option and increased timeouts (120s → 300s)
• /privacy, /terms, /api/cookie-consent, /api/screening/batch-rescreen added as public routes