add deferred account deletion logic with immediate soft deletes

Author: ashutoshgngwr

src/integrationTest/java/com/trynoice/api/identity/AccountControllerTest.java

@@ -41,6 +41,7 @@
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.params.provider.Arguments.arguments;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
@@ -357,11 +358,18 @@ void deleteAccount() throws Exception {
             .andExpect(status().is(HttpStatus.NO_CONTENT.value()));
 
         // validate that all existing refresh tokens have been revoked.
-        refreshTokens.forEach(t -> assertNull(entityManager.find(RefreshToken.class, t.getId())));
+        refreshTokens.stream()
+            .map(t -> entityManager.find(RefreshToken.class, t.getId()))
+            .forEach(t -> assertTrue(t.getExpiresAt().isBefore(OffsetDateTime.now())));
 
-        // perform the request again to ensure access token no longer works
+        // validate that account has been deactivated.'
+        Stream.of(user)
+            .map(u -> entityManager.find(AuthUser.class, u.getId()))
+            .forEach(u -> assertNotNull(u.getDeactivatedAt()));
+
+        // perform a request to ensure access token no longer works
         mockMvc.perform(
-                delete(urlFmt, anotherUser.getId())
+                get("/v1/accounts/profile")
                     .header("Authorization", "Bearer " + accessToken))
             .andExpect(status().is(HttpStatus.UNAUTHORIZED.value()));
     }

src/integrationTest/java/com/trynoice/api/identity/entities/RefreshTokenRepositoryTest.java

@@ -7,6 +7,7 @@
 import org.springframework.transaction.annotation.Transactional;
 
 import javax.persistence.EntityManager;
+import java.time.OffsetDateTime;
 import java.util.stream.Collectors;
 import java.util.stream.IntStream;
 
@@ -25,7 +26,7 @@ public class RefreshTokenRepositoryTest {
     private RefreshTokenRepository refreshTokenRepository;
 
     @Test
-    void deleteAllByOwnerId() {
+    void expireAllByOwnerId() {
         val user = createAuthUser(entityManager);
 
         val ownedRefreshTokens = IntStream.range(0, 5)
@@ -36,13 +37,11 @@ void deleteAllByOwnerId() {
             .mapToObj(i -> createRefreshToken(entityManager, createAuthUser(entityManager)))
             .collect(Collectors.toUnmodifiableList());
 
-        refreshTokenRepository.deleteAllByOwnerId(user.getId());
-        assertTrue(
-            ownedRefreshTokens.stream()
-                .noneMatch(t -> refreshTokenRepository.existsById(t.getId())));
+        refreshTokenRepository.expireAllByOwnerId(user.getId());
+        ownedRefreshTokens.stream()
+            .map(t -> entityManager.find(RefreshToken.class, t.getId()))
+            .forEach(t -> assertTrue(t.getExpiresAt().isBefore(OffsetDateTime.now())));
 
-        assertTrue(
-            unownedRefreshTokens.stream()
-                .allMatch(t -> refreshTokenRepository.existsById(t.getId())));
+        unownedRefreshTokens.forEach(t -> assertTrue(refreshTokenRepository.existsById(t.getId())));
     }
 }

src/main/java/com/trynoice/api/identity/AccountController.java

@@ -271,12 +271,18 @@ ResponseEntity<Void> updateProfile(
     }
 
     /**
-     * Deletes the account of an authenticated user. If the account with the given {@literal
-     * accountId} does not belong to the authenticated user, it returns {@literal HTTP 400}.
+     * <p>
+     * Schedules an account for deletion. If the account with the given {@literal accountId} does
+     * not belong to the authenticated user, it returns {@literal HTTP 400}.</p>
+     *
+     * <p>
+     * Users will immediately lose access to their accounts and their account will be deactivated.
+     * Deactivated accounts are permanently deleted after some time. Users can restore their
+     * deactivated accounts before permanent deletion by completing a successful sign-in.</p>
      *
      * @param accountId must be the account id of the authenticated user.
      */
-    @Operation(summary = "Delete account of the auth user")
+    @Operation(summary = "Schedule the account of the auth user for deletion")
     @ApiResponses({
         @ApiResponse(responseCode = "204", description = "account deleted successfully"),
         @ApiResponse(responseCode = "400", description = "request is not valid"),

src/main/java/com/trynoice/api/identity/AccountService.java

@@ -60,24 +60,24 @@ class AccountService implements AccountServiceContract {
     private final SignInTokenDispatchStrategy signInTokenDispatchStrategy;
     private final Algorithm jwtAlgorithm;
     private final JWTVerifier jwtVerifier;
-    private final Cache<String, Boolean> revokedAccessJwtCache;
-    private final Cache<Long, Boolean> deletedUserIdCache;
+    private final Cache<String, Boolean> revokedAccessJwtsCache;
+    private final Cache<Long, Boolean> deactivatedUserIdsCache;
 
     @Autowired
     AccountService(
         @NonNull AuthUserRepository authUserRepository,
         @NonNull RefreshTokenRepository refreshTokenRepository,
         @NonNull AuthConfiguration authConfig,
         @NonNull SignInTokenDispatchStrategy signInTokenDispatchStrategy,
-        @NonNull @Qualifier(AuthBeans.REVOKED_ACCESS_JWT_CACHE) Cache<String, Boolean> revokedAccessJwtCache,
-        @NonNull @Qualifier(AuthBeans.DELETED_USER_ID_CACHE) Cache<Long, Boolean> deletedUserIdCache
+        @NonNull @Qualifier(AuthBeans.REVOKED_ACCESS_JWTS_CACHE) Cache<String, Boolean> revokedAccessJwtsCache,
+        @NonNull @Qualifier(AuthBeans.DEACTIVATED_USER_IDS_CACHE) Cache<Long, Boolean> deactivatedUserIdsCache
     ) {
         this.authUserRepository = authUserRepository;
         this.refreshTokenRepository = refreshTokenRepository;
         this.authConfig = authConfig;
         this.signInTokenDispatchStrategy = signInTokenDispatchStrategy;
-        this.revokedAccessJwtCache = revokedAccessJwtCache;
-        this.deletedUserIdCache = deletedUserIdCache;
+        this.revokedAccessJwtsCache = revokedAccessJwtsCache;
+        this.deactivatedUserIdsCache = deactivatedUserIdsCache;
         this.jwtAlgorithm = Algorithm.HMAC256(authConfig.getHmacSecret());
         this.jwtVerifier = JWT.require(this.jwtAlgorithm).build();
     }
@@ -160,7 +160,7 @@ public void signOut(@NonNull String refreshJwt, @NonNull String accessJwt) throw
         val refreshToken = verifyRefreshJWT(refreshJwt);
         refreshToken.setExpiresAt(OffsetDateTime.now());
         refreshTokenRepository.save(refreshToken);
-        revokedAccessJwtCache.put(accessJwt, Boolean.TRUE);
+        revokedAccessJwtsCache.put(accessJwt, Boolean.TRUE);
     }
 
     /**
@@ -178,6 +178,10 @@ public AuthCredentialsResponse issueAuthCredentials(@NonNull String refreshToken
         var token = verifyRefreshJWT(refreshToken);
         val owner = token.getOwner();
         owner.updateLastActiveTimestamp(); // update last active timestamp for the user and save.
+        if (owner.getDeactivatedAt() != null) { // restore deactivated account on successful sign-in
+            owner.setDeactivatedAt(null);
+            deactivatedUserIdsCache.invalidate(owner.getId());
+        }
 
         // ordinal 0 implies that this refresh token is being used to sign in, so persist userAgent
         // and reset sign-in attempts.
@@ -283,9 +287,11 @@ public void updateProfile(@NonNull Long userId, @NonNull UpdateProfileParams par
      */
     @Transactional(rollbackFor = Throwable.class)
     public void deleteAccount(@NonNull Long userId) {
-        refreshTokenRepository.deleteAllByOwnerId(userId);
-        authUserRepository.deleteById(userId);
-        deletedUserIdCache.put(userId, Boolean.TRUE);
+        val user = authUserRepository.findById(userId).orElseThrow();
+        user.setDeactivatedAt(OffsetDateTime.now());
+        authUserRepository.save(user);
+        deactivatedUserIdsCache.put(userId, Boolean.TRUE);
+        refreshTokenRepository.expireAllByOwnerId(userId);
     }
 
     @Override
@@ -304,14 +310,14 @@ public Optional<String> findEmailByUser(@NonNull Long userId) {
      */
     Authentication verifyAccessToken(@NonNull String token) {
         // check if the token was revoked during sign-out.
-        if (requireNonNullElse(revokedAccessJwtCache.getIfPresent(token), false)) {
+        if (requireNonNullElse(revokedAccessJwtsCache.getIfPresent(token), false)) {
             log.trace("attempted authentication with a revoked access token");
             return null;
         }
 
         try {
             val auth = new BearerJWT(token);
-            if (!requireNonNullElse(deletedUserIdCache.getIfPresent(auth.principalId), false)) {
+            if (!requireNonNullElse(deactivatedUserIdsCache.getIfPresent(auth.principalId), false)) {
                 return auth;
             }
 

src/main/java/com/trynoice/api/identity/AuthBeans.java

@@ -16,8 +16,8 @@
 @Configuration
 class AuthBeans {
 
-    static final String REVOKED_ACCESS_JWT_CACHE = "revoked_access_jwts";
-    static final String DELETED_USER_ID_CACHE = "deleted_user_ids";
+    static final String REVOKED_ACCESS_JWTS_CACHE = "revoked_access_jwts";
+    static final String DEACTIVATED_USER_IDS_CACHE = "deleted_user_ids";
 
     @NonNull
     @Bean
@@ -62,17 +62,17 @@ public FilterRegistrationBean<CookieAuthFilter> cookieAuthFilterRegistration(Coo
     }
 
     @NonNull
-    @Bean(REVOKED_ACCESS_JWT_CACHE)
-    public Cache<String, Boolean> revokedAccessJwtCache(@NonNull AuthConfiguration authConfig) {
+    @Bean(REVOKED_ACCESS_JWTS_CACHE)
+    public Cache<String, Boolean> revokedAccessJwtsCache(@NonNull AuthConfiguration authConfig) {
         return Caffeine.newBuilder()
             .expireAfterWrite(authConfig.getAccessTokenExpiry())
             .maximumSize(1000) // an arbitrary upper-limit for sanity.
             .build();
     }
 
     @NonNull
-    @Bean(DELETED_USER_ID_CACHE)
-    public Cache<Long, Boolean> deleteUserIdCache(@NonNull AuthConfiguration authConfig) {
+    @Bean(DEACTIVATED_USER_IDS_CACHE)
+    public Cache<Long, Boolean> deactivatedUserIdsCache(@NonNull AuthConfiguration authConfig) {
         return Caffeine.newBuilder()
             .expireAfterWrite(authConfig.getAccessTokenExpiry())
             .maximumSize(1000) // an arbitrary upper-limit for sanity.

src/main/java/com/trynoice/api/identity/entities/AuthUser.java

@@ -53,6 +53,8 @@ public class AuthUser {
 
     private OffsetDateTime lastSignInAttemptAt;
 
+    private OffsetDateTime deactivatedAt;
+
     public void updateLastActiveTimestamp() {
         this.lastActiveAt = OffsetDateTime.now();
     }

src/main/java/com/trynoice/api/identity/entities/RefreshTokenRepository.java

@@ -14,12 +14,13 @@
 public interface RefreshTokenRepository extends CrudRepository<RefreshToken, Long> {
 
     /**
-     * Deletes all instances of the type {@link RefreshToken} for the given {@literal ownerId}.
+     * Marks all instances of the type {@link RefreshToken} as expired for the given {@literal
+     * ownerId}.
      *
      * @param ownerId must not be {@literal null}.
      */
     @Modifying(flushAutomatically = true, clearAutomatically = true)
     @Transactional
-    @Query("delete from RefreshToken e where e.owner.id = ?1")
-    void deleteAllByOwnerId(@NonNull Long ownerId);
+    @Query("update RefreshToken e set e.expiresAt = now() where e.owner.id = ?1")
+    void expireAllByOwnerId(@NonNull Long ownerId);
 }

src/main/resources/db/migration/common/V4.1__Add_deactivated_at_column_to_auth_user.sql

@@ -0,0 +1 @@
+ALTER TABLE auth_user ADD COLUMN deactivated_at timestamp with time zone;