Clean up user accounts in OCL staging/production

[paynejd]

We have several types of user accounts in OCL production/staging:

1. Active users:
   a. Signed into OCL (since May 1, 2021) and have authored some content ==> NO ACTION
   b. Signed into OCL v2 (since May 1, 2021) but have not authored anything ==> NO ACTION
2. Inactive users:
   a. Legitimate accounts that have not signed into OCL v2, but have authored some content ==> DEACTIVATE
   b. Legitimate accounts that have not signed into OCL v2 that have not authored any content ==> DEACTIVATE
   c. Junk accounts that were migrated from OCL v1 ==> DELETE

@snyaggarwal pulled the list of accounts from staging/production, and we have tagged accounts as NO ACTION, DEACTIVATE and DELETE.

The next steps are:

• Delete accounts tagged as DELETE
• Plan how to handle DEACTIVATE accounts, since OCL does not currently have a method to support this
• Implement the DEACTIVATE strategy

[paynejd]

@snyaggarwal to get the list of unused migrated accounts for OCL v2 staging and production.

We'll review and decide which should be inactivated

[snyaggarwal]

@paynejd PFA the list of users last login before 2021-05-01 in production. It has their created date as well. So we can compare last_login and created date to get a better idea.
production_users_last_login_before_20210501.csv

[jamlung-ri]

One more report needed, which is content authored by users. It will further filter the above report.

[jamlung-ri]

@paynejd to review the user list that Sunny sent over, then determine next steps

[snyaggarwal]

@paynejd An OCL admin user can now do following for other users:

1. Deactivate:
   • DELETE /users/<username>/
   • is_active=False
   • verified=False
   • token is deleted
   • On Login re-verification of email is required.
2. Hard Delete:
   • DELETE /users/<username>/?hardDelete=true
   • Will hard delete the users and its associated content (sources/collections).

[jamlung-ri]

@snyaggarwal Should this be working on QA? I did a test in Postman and could not do either a hard or soft delete of a fake user that I made. I did DELETE api.qa.openconceptlab.org/users/fake/.

[snyaggarwal]

@jamlung-ri I just did the hard delete on this api.qa.openconceptlab.org/users/fake/ through postman:
DELETE https://api.qa.openconceptlab.org/users/fake/?hardDelete=true and it worked. You have to be an admin, otherwise, it should deny.

[jamlung-ri]

Looks good! Not sure why I couldn't make it work before but I was able to do both soft and hard deletes.

[snyaggarwal]

@paynejd On Prod users are deleted/deactivated based on the analysis you sent. The sheet is updated.
Moving this task in in-review.

[jamlung-ri]

A quick closeout on this between @paynejd and @snyaggarwal is needed, which we can do on tomorrow's Dev call.

[snyaggarwal]

@paynejd this is also done for Staging