Repository navigation
feat: Add GDPR endpoint to openvsx admin API - #1982
Merged
netomi merged 11 commits intoAug 19, 2026
Merged
Conversation
Contributor
Author
|
Related to the request: EclipseFdn/open-vsx.org#8200 |
autumnfound
force-pushed
the
malowe/main/ovsxorg-8200
branch
from
July 21, 2026 18:38
7e2099c to
9ac5923
Compare
netomi
reviewed
Jul 30, 2026
netomi
reviewed
Jul 30, 2026
netomi
reviewed
Jul 30, 2026
Contributor
|
The PR needs to be rebased on the lasted main branch with the changes to version immutability. Also the decision to remove or keep extension versions on an criteria of namespace membership is flawed. If you are member of a namespace, other people might have published the extensions (that are not member anymore), so deleting these extensions is just wrong if they have not been published by the user to forget. Also, the PR implies that the publisher agreement shall be revoked, if that is the case, all extensions the user published also have to be deactivated / deleted to keep the invariant of the registry (only extensions with active publisher agreement are accessible) |
autumnfound
force-pushed
the
malowe/main/ovsxorg-8200
branch
from
July 30, 2026 19:24
9ac5923 to
421ca3e
Compare
Contributor
Author
|
Change has been rebased and logic for the extension version removal has been updated. It now checks for active + inactive extension versions by the user and does the delete functionality on them. Still outstanding from feedback:
|
Contributor
Author
|
Removed the PA revoke step as right now it is not feasible. We'll need to revisit it in the future, but we can make it a side effect upstream to clear the documents since it's EF controlled atm |
Adds a GDPR endpoint to the OpenVSX API that allows for admin level tokens to request for users to be forgotten. Rather than deleting users, this request will scrub all PII from the existing user records to erase any potential leak of private information. This is done to best retain things like reviews and other user actions within the system while abiding by GDPR requirements. These deletion requests do not remove or modify any of the internal logging that already exists as there is a business need to retain that type of data, which will have it's own retention policy that will eventually purge those records. Assisted-by: Claude Sonnet 4.6
Based on feedback from Thomas N, the behaviour to deactivate extension versions in owned namespaces switched to instead delete versions published by the removed user. This is more inline with legal requirements as the removal of the Open VSX PA would revoke our right to publish the versions by the user.
netomi
force-pushed
the
malowe/main/ovsxorg-8200
branch
from
August 19, 2026 15:10
be13952 to
0cf3fb8
Compare
Rebase conflict resolution in AdminService.java and AdminAPITest.java restored an import order/style that doesn't match the repo's enforced jbang import-sort/formatter (server/scripts/format.sh), which caused the analyse CI check to fail. Ran the actual formatter to fix.
Annotation-argument indentation had drifted from the current Eclipse formatter config; jbang-fmt normalizes it. Verified with prek run --from-ref against main: all hooks pass now.
forgetUser previously always anonymized the UserData row in place, even when nothing in the database still referred to it (e.g. a user who never published, reviewed, or acted as an admin). Now it checks for remaining references - reviews, removed-by markers on extension versions, admin scan/file decisions, audit log entries, and retained (scrubbed) access tokens - and deletes the row outright when none remain, falling back to anonymization otherwise. Adds countByUser/countByDecidedBy/countByRemovedBy repository queries and RepositoryService wrappers to check for each.
generateTokenValue() checks hasAccessToken(value) across all tokens, active or not, to avoid ever reissuing a value already handed out. Nulling the value on scrub would let that check miss a token's old value and let it be handed out again.
…e test RepositoryServiceSmokeTest asserts every public RepositoryService method gets invoked, to catch query/schema mismatches. It was failing after the last commit added countReviews/countVersionsRemovedBy/ countAdminScanDecisions(UserData)/countFileDecisions(UserData)/ countPersistedLogs without exercising them here.
Contributor
|
I updated the PR slightly:
|
netomi
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a GDPR endpoint to the OpenVSX API that allows for admin level tokens to request for users to be forgotten. Rather than deleting users, this request will scrub all PII from the existing user records to erase any potential leak of private information. This is done to best retain things like reviews and other user actions within the system while abiding by GDPR requirements.
These deletion requests do not remove or modify any of the internal logging that already exists as there is a business need to retain that type of data, which will have it's own retention policy that will eventually purge those records.
Assisted-by: Claude Sonnet 4.6