mirror of
https://github.com/projectsend/projectsend.git
synced 2026-10-12 15:58:58 +00:00
ignacionelson
bccf3d1f29
Reported from the shared free instance. A client deleted their own account on 2026-09-18. Their five files kept serving through share links with no expiry for the whole 30-day grace period. Somebody who asked to leave stayed published. Rule 1: once an account is soft-deleted, its uploads are served to nobody but staff. That covers the client scope (assignment, group, shared folder), share links, the public listing, public comments and zips. Staff keep them, because the grace period exists to undo a mistake. Nothing is deleted and share links are kept, so a restored account is served again. A withdrawn share link answers like a token that never existed. In practice this only meets self-deleted accounts: an administrator deleting an account that owns anything must already choose to delete or reassign it. Rule 2, new in Privacy settings: when someone deletes their own account, their files are deleted "when the grace period ends" (the default, and today's behaviour) or "right away". "Right away" uses DeletedAccountContent's cascade: their own uploads, and their folders only if nothing else is left inside. It runs in the same transaction as the account delete. A platform can force "right away" through the new ResolvingSelfDeletion hook. The screen then shows the choice as set by the hosting plan instead of offering a switch. A second setting decides whose deletion both rules apply to: any account (the default) or clients only. A staff member's uploads are often the organization's work for its clients. The delete-account screen now says what happens to the files before the person confirms. New strings are in all sixteen locales.
45 lines
1.4 KiB
PHP
45 lines
1.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Modules\Identity\Erasure\Events;
|
|
|
|
/**
|
|
* "When somebody deletes their own account, do their files go at once?"
|
|
* Asked by SelfDeletion, with the installation's own setting already in
|
|
* $filesImmediately.
|
|
*
|
|
* A hosted platform answers it for some installations. On the free
|
|
* shared instance the files are only ever the customer's own, and the
|
|
* staff who would keep seeing them through the grace period are us, so
|
|
* cloud-modules makes this true there. The settings screen shows the
|
|
* choice as made by the platform rather than offering a switch that
|
|
* would do nothing.
|
|
*
|
|
* Listened to by *string* class name from a package, same as every other
|
|
* hook here — see docs/extension-points-architecture.md.
|
|
*/
|
|
final class ResolvingSelfDeletion
|
|
{
|
|
/**
|
|
* Whether a listener made the choice rather than the setting.
|
|
*/
|
|
public bool $managed = false;
|
|
|
|
public function __construct(
|
|
public bool $filesImmediately,
|
|
) {}
|
|
|
|
/**
|
|
* One direction only, the way ResolvingAttribution moves: a listener
|
|
* can make deletion sooner, never later. A package that could turn
|
|
* "delete my files now" into "keep them for a month" would be
|
|
* overruling a promise the person was shown when they confirmed.
|
|
*/
|
|
public function deleteFilesImmediately(): void
|
|
{
|
|
$this->filesImmediately = true;
|
|
$this->managed = true;
|
|
}
|
|
}
|