Page Comparison

Introduction

...

Send the OTP to the user’s email/phone to validate the user. (OTP templates for user account deletion verification)Insert the entry for all the type as false in sunbird.user_deletion_status.

Sync

Delete login credentials and sessions from Keycloak.
Update the sunbird.user table. Set the following fields as empty: (redis data for the following fields will become empty for that user)
- firstName
- lastName
- email
- dob
- phone
- maskedEmail
- maskedPhone
- prevUsedEmail
- prevUsedPhone
- recoveryEmail
- recoveryPhone
Update the status from ACTIVE to DELETED.
Remove the user entry from sunbird.user_lookup table.
Remove the SSO user entry from sunbird.user_external_identity .Update the user entry in sunbird.user_organisation
Send the AUDIT telemetry event after successful/failure update/deletion of the above tables.
Trigger the delete user kafka event {{env_name}}.delete.user

User Deletion Flink Job

Verify the sync steps is successfully completed else perform the pending actions.
Update the user entry in sunbird.user_organisation (async) - May not be required.
- isdeleted - True
- orgleftdate - system date
Update the user’s name in nodeBB as Deleted User to display in discussion forum.
If a group admin/owner deletes his account, no action required if there is another group admin.If not, another user (random) can be assigned as the default group owner
Insert the entry in sunbird.user_deletion_status table for each type.
Sync the user deletion status in user index in below format:
Code Block"userDeletionStatus" : { "userLookUp": false, "userExtIdnt": true, "keycloak": false "user": true,
Group - TBD
Send the AUDIT telemetry event after successful/failure update/deletion of the above tables.

User delete API:

Request:

Code Block

language	json

curl --location --request DELETE '{{host}}/api/user/v1/delete/{{userId}}' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{api_key}}' \
--header 'x-authenticated-user-token: {{user_token}}'

Response:

Code Block

language	json

{
    "

...

id":

...

"api.user.delete",

...

ver":

...

Call the transferOwnership API with empty array in objects. Value of the status in this table will be inserted as a INITIATED by transfer-ownership Flink job. Sample curl

...

"1.0",
    "ts": "2023-08-28T13:54:45Z+05:30",
    "params": {
        "resmsgid": "a638c46e-63a5-47de-bf00-029cbe435e5e",
        "

...

msgid":

...

 null,
        "

...

err":

...

 null,
        "

...

status": "

...

successful",
        "

...

errmsg": null

...

},

...

 "responseCode"

...

"OK",
    "result"

...

: {
        "

...

response":

...

"SUCCESS",

...

User deletion status table

This table is required for any audit purpose in future by anyone.

Code Block

CREATE TABLE sunbird.user_deletion_status(
	userId text,
	type text,	// userLookUp, userExtIdnt, keycloak, user, discussionForum, userOwnershipTransfer
	status boolean,
	createdDate timestamp,
	upatedDate timestamp,
 	PRIMARY KEY (userId, type)
 );

User delete API:

Request:

Code Block

language	json

curl --location --request DELETE '{{host}}/api/user/v1/delete/{{userId}}' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{api_key}}' \
--header 'x-authenticated-user-token: {{user_token}}'

Response:

Code Block

language	json

{ "userId": "{{userId}}"
    }
}

Delete User Kafka Event

Code Block

{
  "eid": "BE_JOB_REQUEST",
  "ets": 1619527882745,
  "mid": "LP.1619527882745.32dc378a-430f-49f6-83b5-bd73b767ad36",
  "actor": {
    "id": "delete-user",
    "type": "System"
  },
  "context": {
    "channel": "01309282781705830427",
    "pdata": {
      "id": "apiorg.usersunbird.deleteplatform",
      "ver": "1.0"
    },
    "tsenv": "2023-08-28T13:54:45Z+05:30",
 dev"
  },
  "paramsobject": {
        "resmsgid"id": "a638c46e-63a5-47de-bf00-029cbe435e5e",
   <deleted-userId>",
    "msgidtype": null,"DeleteUser"
   },
    "erredata": null,
   {
    "statusorganisationId": "successful<organisationId>",
        "errmsguserId": null
    }"<userId>",
    "responseCodeaction": "OKdelete-user",
    "resultiteration": {
        "response": "SUCCESS",
  1
     "userId": "{{userId}}"
 
  }
}

Delete User Kafka Event

...

Transfer Ownership

Ownership transfer API

...

This API will trigger the kafka event to transfer-ownership flink job, to precess the things asynchronously. This API will validate if “toUserId“ has all the roles of from user.

Request

Code Block

curl --location --request POST '{{host}}/api/user/v1/ownership/transfer' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{api_key}}' \
--header 'x-authenticated-user-token: {{user_token}}' \
--data-raw '{
    "typerequest":{
"System"   },   "contextorganisationId": "{{organisationId}}",
      "channeltoUserId": "01309282781705830427{{TO_UUID}}",
      "pdatafromUserId": "{{FROM_UUID}}"
    }
}'

Response:

Code Block

language	json

{
    "id": "orgapi.user.sunbirdownership.platformtransfer",
 
    "ver": "1.0"
    },
    "envts": "dev"
  },2023-08-28T13:54:45Z+05:30",
    "objectparams": {
        "idresmsgid": "<deleted-userId>",a638c46e-63a5-47de-bf00-029cbe435e5e",
        "typemsgid": "DeleteUser" null,
     },   "edataerr": { null,
        "organisationIdstatus": "<organisationId>successful",
        "userIderrmsg": "<userId>" null
    },
    "actionresponseCode": "delete-userOK",
    "iteration": 1"result": {
        "status": "Ownership transfer event is pushed successfully!"
    }
}

Flink Job

Transfer

...

Ownership transfer API

...

This API will trigger the kafka event to transfer-ownership flink job, to precess the things asynchronously. This API will validate if “toUserId“ has all the roles of from user.

Request

...

ownership:

Sample kafka event

Code Block

{
  "eid": "BE_JOB_REQUEST",
  "ets": 1619527882745,
  "mid": "LP.1619527882745.32dc378a-430f-49f6-83b5-bd73b767ad36",
  "actor": {
    "id": "ownership-transfer",
    "requesttype":{ "System"
  },
  "organisationIdcontext": "{{organisationId}}"
      "fromUserIdchannel": "{{FROM_UUID}}01309282781705830427",
 
    "contextpdata": {
  "User Deletion",  // "User Deletionid",: "Role Changeorg.sunbird.platform", etc.
      "objectsver": ["1.0"
    },
     {"env": "dev"
  },
  "object":  {
    "typeid": "Assetdo_11329603741667328018",
    "type": "OwnershipTransfer"
// Asset, Batch},
Group  "edata": {
    "organisationId": "{{organisationId}}",
    "toUserId": "{{TO_UUID}}",
    "fromUserId": "{{FROM_UUID}}"
      "identifiers"action": ["do_id1", "do_id2"]"ownership-transfer",
       "iteration": 1
  }
    
 ]
    }
}'

Response:

Code Block

language	json

{
    "id": "api.user.ownership.transfer",
    "ver": "1.0",
    "ts": "2023-08-28T13:54:45Z+05:30",
    "params": {
        "resmsgid": "a638c46e-63a5-47de-bf00-029cbe435e5e",
        "msgid": null,
        "err": null,
        "status": "successful",
        "errmsg": null
    },
    "responseCode": "OK",
    "result": {
        "status": "Ownership transfer event is pushed successfully!"
    }
}

Flink Job

Transfer ownership:

Sample kafka event

Code Block

{
  "eid": "BE_JOB_REQUEST",
  "ets": 1619527882745,
  "mid": "LP.1619527882745.32dc378a-430f-49f6-83b5-bd73b767ad36",
  "actor": {
    "id": "ownership-transfer",
    "type": "System"
  },
  "context": {
    "channel": "01309282781705830427",
    "pdata": {
      "id": "org.sunbird.platform",
      "ver": "1.0"
    },
    "env": "dev"
  },
  "object": {
    "id": "do_11329603741667328018",
    "type": "OwnershipTransfer"
  },
  "edata": {
    "organisationId": "{{organisationId}}"
    "fromUserId": "{{FROM_UUID}}",
    "context": "User Deletion", // "User Deletion", "Role Change", etc.
    "objects": [
          {
            "type": "Asset",   // Asset, Batch, Group
            "toUserId": "{{TO_UUID}}",
            "identifiers": ["do_id1", "do_id2"]
          }
      ]
    "action": "ownership-transfer",
    "iteration": 1
  }
}

Update the status to PROCESSING in sunbird.user_ownership_transfer table.
Asset
- Fetch the list of created content/course/batch by fromUserId, using the composite search API.
- Update the createdBy and creator using content system update API.
Batch
- Fetch the list of open and ongoing batches created by fromUserId from sunbird_courses.course_batch table.
- Update the user entry in sunbird_courses.course_batch table for open and ongoing batches only.
  - createdby
- If the user is added as a course mentors to any batch, than use the search API to find out the batches and than remove the userId from mentors column in sunbird_courses.course_batch table.
Groups - Transfer the ownership to any other group admin if any other group admin is available else 1st assign the admin to any member and then transfer the ownership.
Update the status to COMPLETED.

Ownership Transfer Table

Code Block

CREATE TABLE sunbird.user_ownership_transfer_status(
	userId text,
	toUserId text,
	type text,	// Asset, Batch, Group, etc.
	identifier text,
	status text, // INITIATED, SUBMITTED, PROCESSING, COMPLETED
	createdDate text,
    createdBy text,
    updatedDate text,
    updatedBy text,
    context text, // "User Deletion", "Role Change", etc.
    organisationId text,
 	PRIMARY KEY ((userId, type), identifier)
 );

transfer-ownership ES index

create the new elastic search index transfer-ownership to filter the data based on different fields.

List TransferOwnership API

List the users to whom admin wanted to transfer ownership using user ownership transfer list API (new API). fetch the data from transfer-ownership index from ES.

Sample curl for user ownership transfer list API:

Code Block

language	json

curl --location --request POST '{{host}}/api/user/v1/ownership/transfer/list' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer {{api_key}}' \
--header 'x-authenticated-user-token: {{user_token}}'\
--data-raw '{
    "request":{
      "organisationId": ["<organisationId>"], // Mandatory
      "status": ["INITIATED", "SUBMITED"] // Optional. If not passed in request body 
                           // then by default all the status will return.
    }
}'

Sample Response:

...

language	json

...

Batch
- Fetch the list of open and ongoing batches created by fromUserId from sunbird_courses.course_batch table.
- Update the user entry in sunbird_courses.course_batch table for open and ongoing batches only.
  - createdby
- If the user is added as a course mentors to any batch, than use the search API to find out the batches and than remove the userId from mentors column in sunbird_courses.course_batch table.
Groups - Transfer the ownership to any other group admin if any other group admin is available else 1st assign the admin to any member and then transfer the ownership.

Manage Learn -

As part of the Manage Learn use case, the user’s PII data is captured and/or used in the below-mentioned workflows -

A complete snapshot of a user’s profile which includes name (first and last name) as well as masked email and phone is captured under various collections in MongoDB (observations, projects, survey, and programUsers) at the start of any transaction i.e. the moment a user starts working on a survey, or project or decides to join a program. This is done to give the Program manager the details of the user as it was when he/she started working on the resource and is not affected by his/her profile change later. This means a user’s name, location, role, and sub roles which is later used for certificate generation using Sunbird RC is the same when he/she started the resource.
When the Program Manager requests reports via the Program Dashboard about the details of each and every user who has worked on a resource or has joined the program, the user’s email and phone along with the name is provided via a CSV using the Lern Data Product. These details are fetched in real-time at the moment of generating the on-demand report from the common and shared Redis and Cassandra storage. No change is required here since the expectation is user’s name, email phone will be deleted from the common storage and replaced with the “Deleted User” string, We will just need to test this once to confirm the entry from the reports is not removed but just the PII data is removed.

Info
Note - No other place in Logs, Druid, ES or Neo4j does Manage Learn workflow write to

...

Cron Job:
- Run on specific intervals to do the sanity check of deletion.
API for other services to insert/update the data in sunbird.user_
- deletion
_status table.
API for other services to insert/update the data in sunbird.user_ownership_transfer table.
Kafka topic and event structure to notify BBs and services about user deletion activity
- .

Checklist:

Check with Cokreat regarding user PII information stored as part of program - No PII data is stored as part of program. User related data is stored in OpenSABER.

...

Versions Compared

Old Version 9

New Version 10

Key

Introduction

User Deletion Flink Job

User delete API:

User deletion status table

User delete API:

Delete User Kafka Event

Delete User Kafka Event

Transfer Ownership

Ownership transfer API

Request

Response:

Flink Job

Ownership transfer API

Request

Response:

Flink Job

Ownership Transfer Table

transfer-ownership ES index

List TransferOwnership API

Manage Learn -