by Sharif Mehedi · in Developers · assigned to Sharif Mehedi

Summary

Children

Comments

• 7 months, 2 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : I created a new demo project noi4 for testing user deletion. The test case is far from being exhaustive, but it's a beginning.
• 7 months, 2 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : I started writing a unit testcase with Sharif, then continued alone. Still thinking about where to put it. I want a rather minimal demo project, but with uploads (because I want to verify that Lino deletes them after the delay).
• 7 months, 2 weeks ago by Sharif Mehedi in reply to Luc Saffre about #6641 (User deletion form (ForgetMe action)) : We should probably remove it from publisher.
• 7 months, 2 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : I pushed my changes in lino and xl. The test suite passed, but there is more to do.
• 7 months, 2 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : Maybe the ForgetMe action should not even sign out the user. It just sets the timestamp.
• 7 months, 2 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) (1 reply) : Can't we remove the ForgetMe link in the publisher interface? It looks a bit silly in such an exposed place.
• 7 months, 2 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : Together with @8lurry on Jitsi I started a series of code changes to optimize this. It's not finished, but we'll try to continue on it together.
• 7 months, 2 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : TODO in User.on_forget(): lino.modlib.users must not try to know what other plugins do (contacts, vat, peppol). Instead of saying forgettable_partner_fields.update(...), say forgettable_fields = self.get_forgettable_fields(). Similar remark for modifying User.person or User.company.
• 7 months, 3 weeks ago by Sharif Mehedi about #6641 (User deletion form (ForgetMe action)) : How to invalidate other active session from user's other devices when forgetme executes.
• 7 months, 3 weeks ago by Sharif Mehedi about #6641 (User deletion form (ForgetMe action)) : I pushed some changes to different repositories related to ForgetMe action. Please pull these changes.
• 7 months, 3 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : What should ForgetMe do? Actually it would just logout and deactivate the user (set_invalid_password(), set end_date to today), set forget_me_since to ar.now()). And a model mixin user.Forgettable with a method get_forgettable_data() which for uploads would return a queryset of the database rows hav...
• 7 months, 3 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : I created a separate ticket for this: #6642 (Open the sign-in dialog when anonymous asks for an URL that requires auth)
• 7 months, 3 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : Looking at the diff I don't like this solution because it requires the caller (config/bootstrap5/base.html) to decide whether a sign in is needed. I'd prefer it as a general feature: whenever a link that requires authentication is requested by anonymous, the front-end should automatically open a sig...
• 7 months, 3 weeks ago by Sharif Mehedi about #6641 (User deletion form (ForgetMe action)) : I have implemented recursive action support in react. it can now run one action after the other.
• 7 months, 3 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : @8lurry and i had a jitsi session and advanced a bit. Now blurry takes the ball for a while. We "only" need the front end to open the sign-in dialog when an anonymous request asks for the forget_me action...
• 7 months, 3 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : Yesterday together we made a ForgetMe action that works when you're signed in, but we still need a static link tha works for anonymous.
• 7 months, 3 weeks ago by Luc Saffre in reply to Luc Saffre about #6641 (User deletion form (ForgetMe action)) : "the European Court of Justice legally solidified that the "right to be forgotten" is a human right when they ruled against Google in the Costeja case on May 13, 2014." (en.wikipedia.org/wiki/Right_to_be_forgotten)
  
• 7 months, 3 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : The deletion form is technically the same as the verification form. It could ask the user to enter their password (just to protect against accidental deletion) and if the password is correct, ask another confirmation, and then clear the account.
• 7 months, 3 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) : The deletion form won't be a webform. it can be a link to the admin interface. But need to make sure that such a link should open a sign-in form if the user is!t yet authenticated.
• 7 months, 3 weeks ago by Luc Saffre about #6641 (User deletion form (ForgetMe action)) (1 reply) : Makes sense. EU laws require this too. Humans must have the "right to become forgotten". AFAIK this doesn't necessarily mean to delete the user account. It's maybe enough to set username, names, email etc to blank and to mark the account as deleted. I don't think that we are required to merge all de...
• 7 months, 3 weeks ago by Sharif Mehedi about #6641 (User deletion form (ForgetMe action)) : Google play console requires a url pointing to a user deletion form since we have user registration feature.
• 7 months, 3 weeks ago by Sharif Mehedi about #6641 (User deletion form (ForgetMe action)) : Created new Ticket #6641 (User deletion form).