feat: add a cleanup command for accounts without recent activity
This commit is contained in:
fromme committed
1 parent
7ec21c1cac
commit
8a6ce7606f
3 files changed
+488
No files matched your search
@@ -0,0 +1,199 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Command;
|
||||
|
||||
use App\Entity\User;
|
||||
use App\Repository\UserRepository;
|
||||
use App\Security\Role;
|
||||
use Doctrine\ORM\EntityManagerInterface;
|
||||
use Psr\Log\LoggerInterface;
|
||||
use Symfony\Component\Console\Attribute\AsCommand;
|
||||
use Symfony\Component\Console\Command\Command;
|
||||
use Symfony\Component\Console\Input\InputInterface;
|
||||
use Symfony\Component\Console\Input\InputOption;
|
||||
use Symfony\Component\Console\Output\OutputInterface;
|
||||
use Symfony\Component\Console\Style\SymfonyStyle;
|
||||
|
||||
/**
|
||||
* Removes local accounts that carry nothing worth keeping.
|
||||
*
|
||||
* Nothing here destroys customer data: BusPro owns the person, the bookings and the roles, and
|
||||
* BpnAuthenticator rebuilds the local row on the next login (`findOneBy(email) ?? new User()`),
|
||||
* re-deriving the roles, the hotel codes and the profile completeness from the CRM as it goes.
|
||||
* An account is a cache of what BusPro says, so dropping one costs its owner nothing.
|
||||
*
|
||||
* One thing is not rebuilt, and it is the reason every removal gets a log line of its own: the
|
||||
* uuid, minted in the constructor and exported as the OAuth2 `sub` claim (see UserinfoController).
|
||||
* A returning account gets a fresh one, so the old subject cannot be tied to the new row by
|
||||
* anything except that log entry. The SSO clients that gate on a role — E&P Team, E&P Hub — never
|
||||
* see these accounts anyway, since the roles they require are exactly the ones excluded below.
|
||||
*
|
||||
* An account is removed when all of the following hold:
|
||||
*
|
||||
* - it holds no effective role beyond ROLE_CUSTOMER, that role being the fallback for an account
|
||||
* with no privileges at all (see Role::withCustomerFallback()). An account left with no roles
|
||||
* at all is the same state, spelled the way it was before the fallback landed;
|
||||
* - it carries no pending nomination, which would otherwise disappear from /admin/user before
|
||||
* anybody had ruled on it;
|
||||
* - it holds no booking edit draft, and nothing in the Groups subsystem names it.
|
||||
*
|
||||
* --inactive-for adds a "has not signed in for N months" condition on top. It is off by default:
|
||||
* a returning customer is recreated on sight, so age says nothing about whether a row may go.
|
||||
*
|
||||
* Deleting requires --force. The removal cannot be undone and the first run clears thousands of
|
||||
* rows, so a bare invocation reports what it would do and stops. The guard is a flag rather than
|
||||
* an $io->confirm() because the scheduler hands the command a StringInput, which reports itself
|
||||
* as interactive — a confirmation would sit waiting on a STDIN nobody is attached to. A flag
|
||||
* behaves the same way whether a person or cron is running it, and it makes the schedule entry
|
||||
* say out loud that the task destroys data.
|
||||
*/
|
||||
#[AsCommand(
|
||||
name: 'app:cleanup:users',
|
||||
description: 'Removes accounts that hold no role, no draft and no group booking reference',
|
||||
)]
|
||||
class CleanupUsersCommand extends Command
|
||||
{
|
||||
/**
|
||||
* How many accounts are removed between two flushes. The unit of work holds every scheduled
|
||||
* removal until then, and the first run has thousands of rows to get through, so it is a
|
||||
* memory bound rather than a policy one.
|
||||
*/
|
||||
private const BATCH_SIZE = 500;
|
||||
|
||||
public function __construct(
|
||||
private readonly UserRepository $userRepository,
|
||||
private readonly EntityManagerInterface $entityManager,
|
||||
private readonly LoggerInterface $logger,
|
||||
) {
|
||||
parent::__construct();
|
||||
}
|
||||
|
||||
protected function configure(): void
|
||||
{
|
||||
$this
|
||||
->addOption(
|
||||
'inactive-for',
|
||||
null,
|
||||
InputOption::VALUE_REQUIRED,
|
||||
'Only consider accounts without a login for this many months (default: no such limit)',
|
||||
)
|
||||
->addOption(
|
||||
'limit',
|
||||
null,
|
||||
InputOption::VALUE_REQUIRED,
|
||||
'Maximum number of accounts to delete in one run (default: no limit)',
|
||||
)
|
||||
->addOption('dry-run', null, InputOption::VALUE_NONE, 'Show what would be deleted without actually deleting')
|
||||
->addOption('force', null, InputOption::VALUE_NONE, 'Actually delete; without it the command only reports what it would do')
|
||||
;
|
||||
}
|
||||
|
||||
protected function execute(InputInterface $input, OutputInterface $output): int
|
||||
{
|
||||
$io = new SymfonyStyle($input, $output);
|
||||
|
||||
$months = null !== $input->getOption('inactive-for') ? (int) $input->getOption('inactive-for') : null;
|
||||
$limit = null !== $input->getOption('limit') ? (int) $input->getOption('limit') : null;
|
||||
$dryRun = (bool) $input->getOption('dry-run');
|
||||
$force = (bool) $input->getOption('force');
|
||||
|
||||
if ((null !== $months && $months < 1) || (null !== $limit && $limit < 1)) {
|
||||
$io->error('--inactive-for and --limit have to be at least 1 when given.');
|
||||
|
||||
return Command::INVALID;
|
||||
}
|
||||
|
||||
$inactiveSince = null !== $months ? new \DateTimeImmutable(sprintf('-%d months', $months)) : null;
|
||||
|
||||
$candidates = array_values(array_filter(
|
||||
$this->userRepository->findCleanupCandidates($inactiveSince),
|
||||
static fn (User $user): bool => self::isDisposable($user),
|
||||
));
|
||||
|
||||
// After the role filter, never before it: --limit caps the accounts actually deleted, and
|
||||
// the candidate query cannot tell which ones those are.
|
||||
if (null !== $limit) {
|
||||
$candidates = \array_slice($candidates, 0, $limit);
|
||||
}
|
||||
|
||||
if ([] === $candidates) {
|
||||
$io->success('No accounts to remove.');
|
||||
|
||||
return Command::SUCCESS;
|
||||
}
|
||||
|
||||
if (true === $dryRun || false === $force) {
|
||||
$io->table(
|
||||
['E-Mail', 'Letzter Login', 'Rollen'],
|
||||
array_map(static fn (User $user): array => [
|
||||
$user->getEmail(),
|
||||
$user->getLastLoginAt()?->format('Y-m-d') ?? '-',
|
||||
implode(', ', Role::assignedOnly($user->getRoles())) ?: '-',
|
||||
], $candidates),
|
||||
);
|
||||
|
||||
$io->note(sprintf('Would delete %d account(s).', \count($candidates)));
|
||||
|
||||
if (true === $dryRun) {
|
||||
return Command::SUCCESS;
|
||||
}
|
||||
|
||||
// Not a dry run, just an invocation that forgot to say so. Reported as a failure so a
|
||||
// schedule entry missing --force turns into a mail rather than a task that quietly
|
||||
// does nothing every week.
|
||||
$io->error('Refusing to delete without --force. Pass --dry-run to preview, or --force to delete.');
|
||||
|
||||
return Command::INVALID;
|
||||
}
|
||||
|
||||
foreach ($candidates as $index => $user) {
|
||||
// One line per account, before the removal rather than after: once the row is gone
|
||||
// this is the only place left that records which account the uuid belonged to. Worth
|
||||
// a log_entry row per deletion, including the several thousand the first run writes —
|
||||
// they age out with the six-month log retention.
|
||||
$this->logger->info('Deleting account without roles', [
|
||||
'uuid' => $user->getUuid(),
|
||||
'email' => $user->getEmail(),
|
||||
'lastLoginAt' => $user->getLastLoginAt()?->format(\DateTimeInterface::ATOM),
|
||||
'roles' => Role::assignedOnly($user->getRoles()),
|
||||
]);
|
||||
|
||||
$this->entityManager->remove($user);
|
||||
|
||||
if (0 === ($index + 1) % self::BATCH_SIZE) {
|
||||
$this->entityManager->flush();
|
||||
}
|
||||
}
|
||||
|
||||
$this->entityManager->flush();
|
||||
|
||||
$count = \count($candidates);
|
||||
|
||||
$this->logger->info('Deleted accounts without roles', [
|
||||
'count' => $count,
|
||||
'inactiveSince' => $inactiveSince?->format('Y-m-d'),
|
||||
]);
|
||||
|
||||
$io->success(sprintf('Deleted %d account(s).', $count));
|
||||
|
||||
return Command::SUCCESS;
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether the account's role set says it may go. ROLE_CUSTOMER is the fallback rather than a
|
||||
* baseline, so "customer only" and "nothing at all" are the same state — the second being the
|
||||
* spelling accounts kept that have not signed in since the fallback landed.
|
||||
*
|
||||
* Pending markers grant nothing, but they are a nomination waiting for an administrator, so an
|
||||
* account carrying one stays until somebody has ruled on it.
|
||||
*/
|
||||
private static function isDisposable(User $user): bool
|
||||
{
|
||||
$roles = $user->getRoles();
|
||||
|
||||
return [] === Role::pendingOnly($roles)
|
||||
&& [] === array_diff(Role::effectiveOnly($roles), [Role::CUSTOMER]);
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user