bepolytech / ULBDiscordBot

Discord bot to verify a user's ULB studentship
https://hub.docker.com/r/bepolytech/ulbdiscordbot
GNU General Public License v3.0
4 stars 1 forks source link

Maybe remove ALL roles from member on user's unregistration #52

Open LucasPlacentino opened 3 days ago

LucasPlacentino commented 3 days ago

Potential problem

When a user wish to unregister, they use again the /ulb command and click the "confirm delete my data..." button, their server's setup verification role is removed. Should we also remove ALL other roles because those can still permit access to non-public channels even without the server's setup verification role?

Example:

  1. User registers and gets verified -> Gets ULB student role
  2. User can then get other roles through some reaction roles bot to access even more channels
  3. User wishes to unregister this account -> Gets their ULB student role removed
  4. User still has the other roles assigned, so they can still access restricted channels [-This is probably problematic-]

Solution

Loop through all of their roles and removes them all, not only the server's setup verification role.

Should interfere with moderator roles etc because the bot shouldn't have higher permissions than those, so users with higher privileged roles should remove it by themselves

See https://github.com/bepolytech/ULBDiscordBot/blob/dev/classes/utils.py#L196

LucasPlacentino commented 3 days ago

Would be nice to also include a reason for the role removal (shows up in the audit logs)
See Disnake documentation, https://docs.disnake.dev/en/stable/api/members.html#disnake.Member.remove_roles :

await remove_roles(*roles, reason=None, atomic=True)

Parameter: reason (Optional[str]) – The reason for removing these roles. Shows up on the audit log.

Plus, could be used to show a reason on /yearlyUpdate or on an admin command from the administration server (like /user delete [...]