Delete project bot users after converting them to ghost users
Summary
When using Project Access Tokens a bot users is created to hold the access token. When that token is revoked the following happens:
- Token access is revoked
- Bot user is removed from the project
- Bot user is converted to ghost user
During the process of converting the bot user to a ghost user the bot user is blocked. After the conversion is complete the bot user is never actually deleted.
This bot user should be completely deleted unless there is a compelling reason not to.
More discussion about this in !40604 (comment 403975360)
Steps to reproduce
- Create a project
- Create a Project Access Token in
Project
->Settings
->Access Tokens
- Revoke that access token
- Navigate to
/admin/users?filter=blocked
. The bot user will be listed as blocked
What is the current bug behavior?
Bot user is converted to ghost user and blocked
What is the expected correct behavior?
Bot user is converted to ghost user and deleted
Possible fixes
Use Users::DestroyService
, as it migrates the user to a ghost user as well as deletes the user from database.
Edited by Peter Hegman