Page Comparison

Introduction

...

{
  "eid": "BE_JOB_REQUEST",
  "ets": 1619527882745,
  "mid": "LP.1619527882745.32dc378a-430f-49f6-83b5-bd73b767ad36",
  "actor": {
    "id": "delete-user",
    "type": "System"
  },
  "context": {
    "channel": "01309282781705830427",
    "pdata": {
      "id": "org.sunbird.platform",
      "ver": "1.0"
    },
    "env": "dev"
  },
  "object": {
    "id": "<deleted-userId>",
    "type": "User"
  },
  "edata": {
    "organisationId": "<organisationId>"
    "userId": "<deleted-userId>",
    "suggested_users": [
    	{
    		"role": "ORG_ADMIN",
    		"users": ["<orgAdminUserId>"]
    	},
    	{
    		"role": "CONTENT_CREATOR",
    		"users": ["<contentCreatorUserId>"]
    	},
    	{
    		"role": "COURSE_MENTOR",
    		"users": ["<courseMentorUserId>"]
    	}
    ],
    "action": "delete-user",
    "iteration": 1
  }
}

Manage Learn -

As part of the Manage Learn use case, the user’s PII data is captured and/or used in the below-mentioned workflows -

1. A complete snapshot of a user’s profile which includes name (first and last name) as well as masked email and phone is captured under various collections in MongoDB (observations, projects, survey, and programUsers) at the start of any transaction i.e. the moment a user starts working on a survey, or project or decides to join a program. This is done to give the Program manager the details of the user as it was when he/she started working on the resource and is not affected by his/her profile change later. This means a user’s name, location, role, and sub roles which is later used for certificate generation using Sunbird RC is the same when he/she started the resource.

2. When the Program Manager requests reports via the Program Dashboard about the details of each and every user who has worked on a resource or has joined the program, the user’s email and phone along with the name is provided via a CSV using the Lern Data Product. These details are fetched in real-time at the moment of generating the on-demand report from the common and shared Redis and Cassandra storage. No change is required here since the expectation is user’s name, email phone will be deleted from the common storage and replaced with the “Deleted User” string, We will just need to test this once to confirm the entry from the reports is not removed but just the PII data is removed.

As part of the user delete flow we plan to implement the following changes in the Mangage Learn side:-

• Build a Kafka consumer in each micro-service (Survey, Projects, and ML Core) to listen to Kafka events on topic - TBD Point 4 which will do the following thing.

  • Check if any transactions are recorded for this user and if yes, remove all user name, email, and phone entries based on the userId from all collections i.e. projects, surveySubmissions, observations, observationSubmissions, and programUsers of MongoDB.

  • Update the status via API in sunbird.user_deletion_status table. Refer - TBD Point 2

• Build a Kafka consumer in each micro-service (Survey, Projects, and ML Core) to listen to Kafka events on topic - {{envName}}.tranfer.ownership.job.request which will do the following thing.

  • Check if any assets are owned by the deleted user and that the new owner has required platform roles (i.e. Program Manager or Program Designer), if yes update the owner/author in the collections i.e. programs, solutions of MongoDB.

  • Update the status via API in sunbird.user_ownership_transfer table. Refer - TBD Point 3

NOTE: None of the services should log the user PII data.

TBD

• Cron Job:

  • Run on specific intervals to do the sanity check of deletion - Not required

Checklist:

• Check with Cokreat regarding user PII information stored as part of program - No PII data is stored as part of program. User related data is stored in OpenSABER.

OTP Template

• Email

Hello User,

To confirm the deletion of your Sunbird Ed account, please enter the following OTP: [OTP Code].

This OTP is valid for the next [Time Limit, e.g., 5 minutes]. 

If you did not request this account deletion, please ignore this message or contact our support team immediately at [Support Email].

Thank you for using Sunbird Ed.

Best regards,
The Sunbird Ed Team

• SMS

...

Deleted Users search curl

User search API can be used to get the more detail about user. e.g. name.

OTP Template

Hello User,

To confirm the deletion of your Sunbird Ed account, please enter the following OTP: [OTP Code].

This OTP is valid for the next [Time Limit, e.g., 5 minutes]. 

If you did not request this account deletion, please ignore this message or contact our support team immediately at [Support Email].

Thank you for using Sunbird Ed.

Best regards,
The Sunbird Ed Team

• SMS

Dear User, to confirm the deletion of your Sunbird Ed account, please enter the following OTP: [OTP Code].This OTP is valid for the next [Time Limit, e.g., 5 minutes]. If you did not request this account deletion, please ignore this message or contact our support team immediately.

Backward compatibility Approach:

As part of backward compatibility, ‘User Deletion Flink Job’ mentioned above can be deployed; ‘delete-user’ kafka topic can be created and events to the kafka topic can be inserted via scripts by passing users' information as part of the topic for completing user deletion activity.

Manage Learn -

As part of the Manage Learn use case, the user’s PII data is captured and/or used in the below-mentioned workflows -

1. A complete snapshot of a user’s profile which includes name (first and last name) as well as masked email and phone is captured under various collections in MongoDB (observations, projects, survey, and programUsers) at the start of any transaction i.e. the moment a user starts working on a survey, or project or decides to join a program. This is done to give the Program manager the details of the user as it was when he/she started working on the resource and is not affected by his/her profile change later. This means a user’s name, location, role, and sub roles which is later used for certificate generation using Sunbird RC is the same when he/she started the resource.

2. When the Program Manager requests reports via the Program Dashboard about the details of each and every user who has worked on a resource or has joined the program, the user’s email and phone along with the name is provided via a CSV using the Lern Data Product. These details are fetched in real-time at the moment of generating the on-demand report from the common and shared Redis and Cassandra storage. No change is required here since the expectation is user’s name, email phone will be deleted from the common storage and replaced with the “Deleted User” string, We will just need to test this once to confirm the entry from the reports is not removed but just the PII data is removed.

As part of the user delete flow we plan to implement the following changes in the Mangage Learn side:-

• Build a Kafka consumer in each micro-service (Survey, Projects, and ML Core) to listen to Kafka events on topic - TBD Point 4 which will do the following thing.

  • Check if any transactions are recorded for this user and if yes, remove all user name, email, and phone entries based on the userId from all collections i.e. projects, surveySubmissions, observations, observationSubmissions, and programUsers of MongoDB.

  • Update the status via API in sunbird.user_deletion_status table. Refer - TBD Point 2

• Build a Kafka consumer in each micro-service (Survey, Projects, and ML Core) to listen to Kafka events on topic - {{envName}}.tranfer.ownership.job.request which will do the following thing.

  • Check if any assets are owned by the deleted user and that the new owner has required platform roles (i.e. Program Manager or Program Designer), if yes update the owner/author in the collections i.e. programs, solutions of MongoDB.

  • Update the status via API in sunbird.user_ownership_transfer table. Refer - TBD Point 3

NOTE: None of the services should log the user PII data.

References

• [PRD] Delete Account functionality

• https://docs.google.com/presentation/d/1EoRJD8KWd0002hHtxc4PWwAVB0FQr_Z5l4PUOsvxpdQ/edit?pli=1#slide=id.p

• Apple App Store - https://developer.apple.com/support/offering-account-deletion-in-your-app

• Google Play Store - https://support.google.com/googleplay/android-developer/answer/13327111?hl=en