First part of GDPR support (#244): the right to erasure and the right
to access.
- DELETE /api/v1/contacts/{id} permanently deletes a contact or
visitor. Conversations, messages, notes, and participants go with it
via DB cascades. The avatar file is removed too.
- GET /api/v1/contacts/{id}/export downloads a JSON file with
everything stored about the contact: profile, custom attributes, and
all conversations with their messages. Private notes stay internal.
- Both actions are gated by new permissions (contacts:delete,
contacts:export), granted to Admin in migration v2.6.0, and recorded
in the activity log with actor and IP.
- Contact page gets Export data and Delete contact buttons, with a
confirm dialog for delete.
- The unlinked media cleaner now also removes attachment files whose
message no longer exists. Before this, deleting a conversation left
its attachments on disk forever.
- Update all SQL queries to add missing columns
- Update the create conversation API to allow setting the initiator of a conversation. For example, we might want to use this API to create a conversation on behalf of a customer, with the first message coming from the customer instead of the agent. This param allows this.
- Minor refactors and clean up
- Tidy go.mod
- Rename structs to reflect purpose
- Create focus structs for scanning JSON payloads for clarity.
- single table stores acitivites against entities, actors, timestamps, ip addresses and activity description.
- admin page to view, sort and filter activity logs.
- new `activity_logs:manage` permission
Abhinav Raut