Prosody Integration and account handling issues

[jbarrett]

• Some UTF-8 characters in the password field are troublesome (try creating an account with '€' in the password).
• Auth is done over HTTP. While both services are on the same host, this isn't a huge deal. We should switch to XMPP or HTTPS.

• 363 Deleted users not completely deleted

I suspect our UTF-8 issues would be resolved by using an XMPP module to register the Prosody account. Depending on how long this tends to take, we could move it to a job queue of sorts (we do a lot of emailing and indexing within HTTP sessions which could happen after - see #270).

It should be possible to do XMPP authentication without performing much of the additional session lifetime elements - buddy list retrieval and such should be skipped.

While there is a fix for #363, other considerations around content deletion need to be decided (Comments, threads, translations, IA ideas, IA page permissions, attributions etc., account details...)

[jbarrett]

There is a user account called 'deleted' which is configured in DDGC->config->deleted_user.

What currently occurs on user deletion:

https://github.com/duckduckgo/community-platform/blob/bd6ce62/lib/DDGC.pm#L711-L764

• Translation contributions user is set to 'deleted'
• Comments content is replaced and user is set to 'deleted'
• Threads are ghosted and user is set to 'deleted'

Taking a look at the User model's relationships should inform what else we should be handling:

https://github.com/duckduckgo/community-platform/blob/bd6ce62/lib/DDGC/DB/Result/User.pm#L146-L203

• Data in users table itself - should lose everything but the username (to prevent duplicate registrations later)
• IA ideas
• Blog articles
• Screenshots? Avatars?
• IA page editing rights? Attribution? (Are there other relationships with IA pages?)

Some suggestions for IA attribution in #456

ping @jdorweiler @zekiel @russellholt @MariagraziaAlastra

[MariagraziaAlastra]

@jbarrett there's also the assignee/sponsor for the IA Page - this would be an admin watching over any activity and committing edits, adding metadata etc.

[jbarrett]

What's actually stored in that column? If it's a DDGC user, it should refer to it with users_id (though one of the translation system tables uses username...)

[MariagraziaAlastra]

I guess this uses username as well since it features 'text' as data-type. Maybe it would be more convenient to have the users_id, though. Probably an has_many relation on the Users table would work better, since an assignee is likely to have quite more than just one IA Page to watch over.

[jbarrett]

It can be worked around, but many-to-many accessors are worth it for longer term convenience, I think.

[MariagraziaAlastra]

I agree, let's have a task for that.