Moderator tools: merge account

desnoes commented 7 years ago

It should be possible to merge 2 users accounts. At least an user with 'compte fermé'. The identifiers (topo and forum) of a merged account shall not be visible in any document and in the forum. All documents that have been created or modified shall be updated. All the messages of the forum shall be updated.

asaunier commented 7 years ago

Note: should rather be an API issue because most of the tasks are performed on the API side.

@desnoes Should this tool be available form the UI (website)? If yes, who should be able to merge accounts? Moderators? Or should we keep the v5-approach (a script to run by hand in the server command line)?

Note: source of v5 command line tool https://github.com/c2corg/camptocamp.org/blob/master/batch/mergeUsers.php

Some tasks from the document merging or deleting tools could perhaps be reused:

Tasks performed when merging accounts

Discourse tasks:

[ ] reaffect topics/posts (including private messages) from source user to target user
[ ] remove the source user account in discourse @arnaud-morvan what do you think?

Guidebook tasks:

[x] remove geoassociations of the source user (if profile is georeferenced)
[x] transfer associations (outings, xreports, images, etc.) to the target user. Perhaps https://github.com/c2corg/v6_api/blob/master/c2corg_api/views/document_merge.py#L136
[x] transfer feed entries => also update the user_ids attribute
[x] reaffect edited document's history_metadata from the source user to the target user https://github.com/c2corg/v6_api/blob/master/c2corg_api/models/document_history.py#L18-L30
[x] reaffect association logs from the source user to the target user https://github.com/c2corg/v6_api/blob/master/c2corg_api/models/association.py#L78-L108
[x] delete the mailing lists subscriptions of the source user https://github.com/c2corg/v6_api/blob/master/c2corg_api/models/mailinglist.py#L9-L35
[x] delete the profile of the source user, including archives, locales and locale archives (perhaps we could use some parts of the existing document deleting tool https://github.com/c2corg/v6_api/blob/master/c2corg_api/views/document_delete.py)
[x] delete the actual user account of the source user https://github.com/c2corg/v6_api/blob/master/c2corg_api/models/user.py#L60

If command line interface:

[x] actions above should be run in a script, not in a view (as for document merging or deleting), a bit like the v5-v6 migration script (see https://github.com/c2corg/v6_api/blob/master/c2corg_api/scripts/migration/README.md and https://github.com/c2corg/v6_api/blob/master/c2corg_api/scripts/migration/migrate.py)

[x] script should be run through a docker command like

docker-compose run --rm api .build/venv/bin/python c2corg_api/scripts/admin/merge_users.py <source id> <target id>

@arnaud-morvan Sounds good to you?

If web interface is needed (is it??): TBD

arnaud-morvan commented 7 years ago

I trust you on the topoguide side, there is a bunch of relationships with users, but this sounds reasonably feasible, as we have direct access to ORM, so this can be done in one request / transaction.

I've already done that sort of stuff in discourse, because some users have changed their email during forum migration, see : https://github.com/c2corg/v6_forum/issues/90.

So I've searched for user's posts and manually changed owner one by one on each post through discourse UI (passing through ORM). As far as I know, there is no discourse tool to do this as batch (and I've searched for). This may be possible through Discourse API, but it should result in a lot of requests, not included in a transaction, and we may encounter an error in the middle of process.

Concerning private messages, I've done it directly in SQL, but this is not the recommended way of changing data in discourse. No idea if this is possible through API. Note that Topoguide API process do not have direct access to discourse database.

There should be other thing related to users in discourse, but this not really relevant I suppose. After changing posts owner, I was able to delete the user.

desnoes commented 7 years ago

@desnoes Should this tool be available form the UI (website)? If yes, who should be able to merge accounts? Moderators? Or should we keep the v5-approach (a script to run by hand in the server command line)?

I have no experience in merging account. Was it frequent in V5 ? If not and running a script by hand is not too cumbersome, let's go for it.

fbunoz commented 7 years ago

I have no experience in merging account. Was it frequent in V5 ? If not and running a script by hand is not too cumbersome, let's go for it.

Merging an account is also used to delete an account, as all spamer accounts. With spamers ang regular users, we need merge about 100 to 200 account per year.

asaunier commented 7 years ago

I have no experience in merging account. Was it frequent in V5 ?

Use cases are:

users that have created several accounts (because they have lost their password and access to the registered email address)
users that want to be anonymized (accounts are then merged with the special "compte fermé" account)
spammer accounts that are banned.

For the spammers, in v5 those accounts were either deleted or merged with the "compte fermé", especially when all there messages had not been deleted yet. There were 2 scripts, 1 for deleting and 1 for merging. In v6 is it complicated to remove spam messages? Anyway the accounts have to be removed, so perhaps it is better to stick to the merging procedure instead of developing a special "deleting" tool for those accounts.

Using a web interface

2 tools could be created:

a deleting tool (actually a tool that would merge the source user account with the "compte fermé") => could be offered to users to delete their own account?!
a tool to merge the current user account to whatever other account (a bit like the document merging tool already available but for user accounts)

Pros:

no need to have access to the server (only some developers have access to the server)
same procedure than for blocking an account (but it would irreversible!!)
users could merge their own account without asking the moderators/admins to do so (but perhaps it's better to have people think about it before actually proceeding?)

Cons:

a special permission would probably be needed (admin?) to have access to the merging command (can we really allow guidebook moderators to proceed?) => that adds quite a lot of work just to create the "admin" category.
the web interface and/or API should be really secured to prevent a malicious users from deleting other user accounts.

Using a script

Pros:

more secure because harder to have access to the tool
probably simpler / less work to do

Cons:

only a few people will have access to the tool (some developers)
operators have to know what command to type (documented in the wiki as for updating the demo/prod ? https://github.com/c2corg/v6_api/wiki/Upgrade-the-prod-server) and what user ids to use
operators might mistype the user ids (as in v5 actually) and remove the wrong user account => confirmation is needed (ditto for the web interface)

asaunier commented 6 years ago

The API PR https://github.com/c2corg/v6_api/pull/660 has finally been merged. Please note it has no impact on the Discourse side.