OCP API for apps that can export and delete user data for compliance

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Is your feature request related to a problem? Please describe.

Currently there is no standardized way of exporting or deleting data of one user for an app.

Describe the solution you'd like

An API where apps can register that they are capable of handling a data export or deletion.

It should roughly work like this

1. There are interfaces an app implements for the distinctive operations like export and deletion. Apps can choose to only support some of the operations
2. Apps register their code on the bootstrap context https://docs.nextcloud.com/server/stable/developer_manual/app_development/bootstrap.html#bootstrapping-process
3. If an export or deletion is triggered (CLI/web) then all registered services will be called to trigger an export
4. The export can sometimes happen immediatelly, when the operation is cheep (simple db query that takes only a few ms to process) or async in a background job when the operation might take longer.
5. There is some bookkeeping code that tracks which services were triggered and which ones are done. Once everyone has returned, the export or deletion confirmation can be sent to the admins or just the user who requested this info

Describe alternatives you've considered

n/a

Additional context

Because it worked well with other new APIs I would suggest that each of the methods that invoke an export or deletion get an IUser object and an additional context object as arguments. That context object allows us to pass in any other additional infos/flags/whatever later on without breaking the APIs.

This is an old idea @rullzer and I had. Originally this was not based on bootstrap registration but events. By current standards that would be an anti pattern and not a proper API. I've updated this accordingly.

Additional questions

1. Do we need to distinguish between different types of exports/deletions, e.g. GDPR export vs some other export?
2. Where would we store the data? Do we provide apps with something like an abstracted filesystem folder where they can put anything? That folder could be located in the app data directory and scoped so that apps don't see each other (and don't overwrite anything)

cc @AndyScherzinger @LukasReschke

Start with the app bootstrap registration documentation linked in the issue and review how apps currently expose services. Before implementation, resolve the open questions about export types, storage, synchronous versus background work, and completion tracking; done means the API contract and integration path are agreed and covered by appropriate tests.