From 6f061d321254a3eb24636eb6efa89cb5e064c69b Mon Sep 17 00:00:00 2001 From: jjoonleo Date: Sun, 10 May 2026 12:33:07 +0900 Subject: [PATCH] docs: add backend deletion verification checklist (#439) --- ...issue-439-backend-deletion-verification.md | 92 +++++++++++++++++++ ...issue-439-backend-deletion-verification.md | 65 +++++++++++++ 2 files changed, 157 insertions(+) create mode 100644 handoff/issue-439-backend-deletion-verification.md create mode 100644 plans/issue-439-backend-deletion-verification.md diff --git a/handoff/issue-439-backend-deletion-verification.md b/handoff/issue-439-backend-deletion-verification.md new file mode 100644 index 00000000..c14d7cdb --- /dev/null +++ b/handoff/issue-439-backend-deletion-verification.md @@ -0,0 +1,92 @@ +# Issue 439 Backend Deletion Verification Handoff + +Issue: #439, parent track #464 +Branch: `codexd/439-backend-deletion-verification` +Status: externally blocked +Date: 2026-05-10 + +## Summary + +Repo-side review found no frontend code change that can honestly complete #439. +The release client already routes account deletion by provider, and the remaining +acceptance criteria require backend owner confirmation of real server-side +deletion and retention behavior. + +Use this document as the evidence form for the backend owner, privacy owner, and +release QA owner. Treat all filled-in values as release evidence. + +## Repo-Side Evidence Already Available + +- Normal account deletion uses `DELETE /users/me/delete`. +- Google account deletion uses `DELETE /oauth2/google/me`. +- Apple account deletion uses `DELETE /oauth2/apple/me`. +- Optional deletion feedback is sent in the deletion request body when present. +- The app chooses the endpoint from `GET /users/me` `socialType`. +- PR #378 added deletion endpoint routing and tests. +- PR #471 verified in-app deletion UX and success/failure behavior. + +## Backend Verification Prerequisites + +- Backend owner or environment operator with access to the release backend data + store. +- Test accounts for every auth provider enabled in the release build: + - Normal account + - Google account + - Apple account +- Agreement on the environment to verify, for example staging release candidate + or production-equivalent backend. +- Privacy/product owner available to compare the verified behavior against the + privacy policy draft. + +## Provider Evidence + +Fill one row per auth provider that is enabled in the release build. Do not add +Kakao unless it is active in the release build. + +| Provider | Endpoint Called | Environment | Test Account ID | Request Time | Response | Re-login Fails? | Owner | Evidence Link | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | +| Normal | `DELETE /users/me/delete` | TBD | TBD | TBD | TBD | TBD | TBD | TBD | +| Google | `DELETE /oauth2/google/me` | TBD | TBD | TBD | TBD | TBD | TBD | TBD | +| Apple | `DELETE /oauth2/apple/me` | TBD | TBD | TBD | TBD | TBD | TBD | TBD | + +## Data Deletion and Retention Matrix + +Backend owner must replace `TBD` values with verified behavior. If a row is not +part of the backend data model, mark it `N/A` and explain why. + +| Data Category | Backend Location | Deleted, Anonymized, Retained, or N/A | Retention Duration | Retention Reason | Verification Method | Owner | +| --- | --- | --- | --- | --- | --- | --- | +| User profile fields such as email, name, and social identity | TBD | TBD | TBD | TBD | TBD | TBD | +| Password or auth credentials for normal accounts | TBD | TBD | TBD | TBD | TBD | TBD | +| OAuth provider linkage or revoke state for Google | TBD | TBD | TBD | TBD | TBD | TBD | +| OAuth provider linkage or revoke state for Apple | TBD | TBD | TBD | TBD | TBD | TBD | +| Access and refresh tokens | TBD | TBD | TBD | TBD | TBD | TBD | +| Device records and FCM tokens | TBD | TBD | TBD | TBD | TBD | TBD | +| Alarm settings and alarm status | TBD | TBD | TBD | TBD | TBD | TBD | +| Default preparation settings | TBD | TBD | TBD | TBD | TBD | TBD | +| Schedules | TBD | TBD | TBD | TBD | TBD | TBD | +| Schedule preparation steps | TBD | TBD | TBD | TBD | TBD | TBD | +| Spare time setting | TBD | TBD | TBD | TBD | TBD | TBD | +| General feedback sent through `/feedback` | TBD | TBD | TBD | TBD | TBD | TBD | +| Account deletion feedback sent in delete request body | TBD | TBD | TBD | TBD | TBD | TBD | +| Operational logs, audit logs, crash logs, analytics, or monitoring events | TBD | TBD | TBD | TBD | TBD | TBD | +| Backups or disaster recovery snapshots | TBD | TBD | TBD | TBD | TBD | TBD | + +## Privacy Policy Cross-Check + +Before closing #439, confirm the privacy policy draft states: + +- Which account and app data is deleted after account deletion. +- Which data is retained, why it is retained, and for how long. +- Whether deletion feedback or support messages may be retained. +- Whether logs or backups retain account-related data temporarily. +- Which auth providers are supported in the release build. + +## Exact Remaining Human Tasks + +- Backend owner completes the provider evidence table. +- Backend owner completes the data deletion and retention matrix. +- Privacy/product owner reconciles the completed evidence with the privacy + policy draft for #434. +- Release owner updates #439 with the completed evidence and decides whether the + backend behavior satisfies the acceptance criteria. diff --git a/plans/issue-439-backend-deletion-verification.md b/plans/issue-439-backend-deletion-verification.md new file mode 100644 index 00000000..981b7bcb --- /dev/null +++ b/plans/issue-439-backend-deletion-verification.md @@ -0,0 +1,65 @@ +# Issue 439 Backend Deletion Verification Plan + +Issue: #439, parent track #464 +Status: externally blocked by backend owner or environment access +Date: 2026-05-10 + +## Goal + +Verify that backend account deletion removes or retains OnTime user data exactly +as the release privacy policy will describe. + +## Current Repo Facts + +- The release track orders #439 immediately after #438. +- #438 is closed by PR #471, which verified the in-app deletion UX. +- PR #378 routes deletion requests through the release client endpoints and + includes tests for optional feedback payloads and auth-provider routing. +- The client deletion endpoints currently used by the app are: + - Normal account: `DELETE /users/me/delete` + - Google account: `DELETE /oauth2/google/me` + - Apple account: `DELETE /oauth2/apple/me` +- The app checks `GET /users/me` for `socialType` before choosing the deletion + endpoint. + +These facts verify client behavior only. They do not verify server-side data +deletion, third-party token revocation, audit logging, backups, or retention. + +## Decision-Complete Plan + +1. Backend owner identifies every persisted data category tied to a user in the + release backend, including user profile, auth identity, tokens, devices, FCM + tokens, alarm settings, default preparations, schedules, schedule + preparations, feedback, deletion feedback, logs, analytics, and backups. +2. Backend owner runs deletion for each auth provider supported in the release + build: normal, Google, and Apple. Do not test or document Kakao unless it is + enabled in the release build. +3. For each provider, backend owner records the deletion endpoint called, + environment, account identifier, timestamp, response, and post-deletion + database/API evidence. +4. For each data category, backend owner records whether it is deleted, + anonymized, retained, or not applicable, plus the retention reason and + duration when retained. +5. Product or privacy owner compares the verified backend behavior with the + privacy policy draft before approving #434. +6. If backend behavior and policy text diverge, fix the backend or update the + policy before closing #439. +7. Once verified, use the #439 evidence to unblock #441 Data safety and #458 + account deletion end-to-end QA. + +## Acceptance Mapping + +- Backend behavior verified for each release auth provider: requires backend + owner evidence for normal, Google, and Apple accounts. +- Associated user data deletion confirmed by data type: use the evidence matrix + in `handoff/issue-439-backend-deletion-verification.md`. +- Retained data and retention reason documented: use the retention columns in + the handoff matrix. +- Privacy policy text matches backend behavior: complete only after #434 has a + policy draft and owner review against this evidence. + +## Exit Criteria + +#439 can be closed only after a backend owner or environment operator provides +the completed evidence matrix and a product/privacy owner confirms that the +privacy policy text matches the verified behavior.