Repository navigation
fix(api): gate the scheduled purge to production; purge deletes private data - #255
Merged
Merged
Conversation
…vate data v0.10.2's sandbox ran the sweep against the published branch it shares with production, and purge never deleted private data. Only the deployment with CFP_SCHEDULED_PURGE=true sweeps; purge deletes the person's private profile, legacy password, reset tokens, claim requests and sessions in the same transaction; an admin endpoint clears private data left by earlier purges, counts first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGqwPjt3v4eMfiHpPmCKnR
- CFP_SCHEDULED_PURGE (default "false") must be "true" for a pod to sweep; otherwise it logs that the sweep is disabled. - PrivateStoreTx.deletePersonData removes profile, legacy password, reset tokens and claim requests; purge stages it with the public delete and clears session metadata after the commit. - POST /api/admin/private-data/purge-orphans (admin, apply: false|true) clears private data of people with no public record, under the write lock, answering counts only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGqwPjt3v4eMfiHpPmCKnR
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGqwPjt3v4eMfiHpPmCKnR
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGqwPjt3v4eMfiHpPmCKnR
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the v0.10.2 incident: #253 shipped early and the sandbox ran the scheduled sweep against the
publishedbranch it shares with production, purging 27 spam-voted accounts there. That also showed purge never touched the private store.CFP_SCHEDULED_PURGE(default"false"). Only a pod with"true"sweeps, which will be cfp-live-cluster alone. Otherwise the pod logsscheduled spam purge disabledat boot and never runs (not at ready, not on the timer). Deploy env table updated.PrivateStoreTx.deletePersonDataremoves the private profile, legacy password, password-reset tokens and account-claim requests naming the person, staged with the public delete in the samestore.transact; session metadata is cleared after the commit.POST /api/admin/private-data/purge-orphans(administrator;{ "apply": false }counts,{ "apply": true }deletes). Runs inside the API under the write lock, because the API rewrites whole private-store files from memory, so an out-of-process script would be undone. Counts only, never emails. Runbook has a console snippet.Specs: person-lifecycle.md, api/moderation.md. Docs: deploy.md, runbook.md. Plan:
plans/purge-gate-and-private-data.md. Tests: gate,deletePersonDatapersisted (others untouched), purge drops the private profile, cleanup admin-only / count / apply / idempotent. Gate clean; devbox with the flag unset logged "disabled" and wrote nothing.Release: set
CFP_SCHEDULED_PURGE=truein cfp-live-cluster's config in the same deploy; leave sandbox unset. After production is live, run the cleanup with Chris's OK (count first).🤖 Generated with Claude Code
https://claude.ai/code/session_01TGqwPjt3v4eMfiHpPmCKnR