MG - 1529 - User Removal

[rodneyosodo]

What type of PR is this?

This is a feature because it adds user removal

What does this do?

This PR adds a new method to delete a user with a given ID in the repository package. The implementation of this method uses an SQL query to delete the client from the database.

Additionally, an extra method has been added to the gRPC auth service to handle entity deletion. This is useful because it reduces network trips back and forth from the client microservices to the auth microservice. Test cases have been added for the delete method to ensure its functionality.

Which issue(s) does this PR fix/relate to?

• Resolves Add user removal and/or blocking feature #1529

Have you included tests for your changes?

Yes, I have included tests for my changes.

Did you document any new/modified feature?

Yes, I have updated the documentation for the new feature.

Notes

[arvindh123]

@rodneyosodo We are planning like, only super admins can delete users

[rodneyosodo]

Yes. It is only super admins who can delete users

[rodneyosodo]

Should I also add that a user can be able to delete themselves?

[arvindh123]

For svc.DeletePolicy only object Type is required field.
So the below snippet will delete all type of subjects related to thing object

Suggested change

	req := PolicyReq{
	SubjectType: GroupType,
	Object: id,
	ObjectType: ThingType,
	}
	if err := svc.DeletePolicy(ctx, req); err != nil {
	return err
	}
	// Remove policy from domain
	req.SubjectType = DomainType
	if err := svc.DeletePolicy(ctx, req); err != nil {
	return err
	}
	// Remove policy of users
	req.SubjectType = UserType
	if err := svc.DeletePolicy(ctx, req); err != nil {
	return err
	}
	return nil
	// Remove all policies related to thing
	req := PolicyReq{
	Object: id,
	ObjectType: ThingType,
	}
	if err := svc.DeletePolicy(ctx, req); err != nil {
	return err
	}
	return nil

[rodneyosodo]

This doesn't work. I get

{"time":"2024-03-21T08:36:41.624438869Z","level":"WARN","msg":"Delete entity policies failed to complete successfully","duration":"284.946µs","entity_type":"thing","id":"feae8203-452b-4f7c-a003-76b475e43b56","error":{"error":"malformed entity specification","message":"failed to remove the policies"}}

[arvindh123]

This below snippet will delete all Thing, Group, Channel relation related to user id within the domain

Suggested change

	policy := PolicyReq{
	Subject: EncodeDomainUserID(domain.ID, id),
	SubjectType: UserType,
	Object: domain.ID,
	ObjectType: DomainType,
	}
	if err := svc.agent.DeletePolicy(ctx, policy); err != nil {
	return err
	}
	policy := PolicyReq{
	Subject: EncodeDomainUserID(domain.ID, id),
	SubjectType: UserType,
	ObjectType: ThingType,
	}
	if err := svc.agent.DeletePolicy(ctx, policy); err != nil {
	return err
	}
	policy = PolicyReq{
	Subject: EncodeDomainUserID(domain.ID, id),
	SubjectType: UserType,
	ObjectType: GroupType,
	}
	if err := svc.agent.DeletePolicy(ctx, policy); err != nil {
	return err
	}
	policy = PolicyReq{
	Subject: EncodeDomainUserID(domain.ID, id),
	SubjectType: UserType,
	Object: domain.ID,
	ObjectType: DomainType,
	}
	if err := svc.agent.DeletePolicy(ctx, policy); err != nil {
	return err
	}

[arvindh123]

There is no need to remove policy between user_id and things/groups, because,There will be no subject just with user id in spicedb.
User's Subject id in spicesdb will be always combination <domain_id>_<user_id>

Suggested change

	req := PolicyReq{
	Subject: id,
	SubjectType: UserType,
	ObjectType: ThingType,
	}
	if err := svc.agent.DeletePolicy(ctx, req); err != nil {
	return err
	}
	req.ObjectType = GroupType
	if err := svc.agent.DeletePolicy(ctx, req); err != nil {
	return err
	}
	req.ObjectType = DomainType
	if err := svc.agent.DeletePolicy(ctx, req); err != nil {
	return err
	}
	req := PolicyReq{
	Subject: id,
	SubjectType: UserType,
	ObjectType: PlatformType,
	req.Object = MagistralaObject
	}
	if err := svc.agent.DeletePolicy(ctx, req); err != nil {
	return err
	}

[rodneyosodo]

If we leave it spiceDB will see it as a valid policy and will not clean up

[arvindh123]

Hello @rodneyosodo left some comments for delete policies in auth service.